Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T05:17:09.747Z",
  "pubdate": "2026-09-01T05:17:09.747Z",
  "executiveSummary": "The Frontend Admin plugin for WordPress (all versions up to and including 3.29.12) contains a critical security vulnerability involving improper neutralization of input during file path operations.\nThis flaw allows unauthenticated remote attackers to execute arbitrary file deletion on the underlying server filesystem.\nThe vulnerability resides in the move_folders function, which fails to adequately sanitize user-supplied path data.\nThe impact is severe; by deleting sensitive configuration files such as wp-config.php, an attacker can trigger a site re-installation process or bypass authentication, potentially leading to full Remote Code Execution (RCE) and complete server compromise.\nExploitation is feasible without authentication provided the WordPress site contains at least one form configured with 'public' visibility, which inadvertently exposes the necessary security nonce to unauthenticated users.\nGiven the severity and the ease of exploitation, this vulnerability poses a significant risk to the integrity and availability of affected WordPress installations.",
  "technicalDetails": "The vulnerability is rooted in the move_folders function within the Frontend Admin plugin codebase. The function fails to perform rigorous validation or path canonicalization on input parameters intended to facilitate directory management or file operations.\nThe root cause is an insecure implementation of file system manipulation logic that permits directory traversal or direct path injection. Because the function does not verify if the target path resides within an intended, restricted sandbox, it allows the process to interact with files outside the intended scope.\nThe attack flow commences with the attacker identifying a publicly accessible form created by the Frontend Admin plugin. When a form is configured with 'who_can_see' set to 'all', the plugin renders a nonce required for form-related actions directly into the HTML source of the page. An unauthenticated attacker can harvest this nonce via a simple HTTP GET request to the affected page.\nOnce the nonce is obtained, the attacker sends a crafted HTTP POST request targeting the vulnerable endpoint associated with the move_folders function. By manipulating parameters that influence the target file path, the attacker can specify arbitrary locations on the server's filesystem. The application then processes this request using the compromised nonce, bypassing security checks that would otherwise enforce administrative access.\nThe move_folders function subsequently executes a filesystem deletion command on the provided path with the privileges of the web server user. If the attacker targets critical files such as wp-config.php, the server's configuration state is effectively invalidated. In many WordPress environments, the removal of wp-config.php forces the application into an installation sequence, which the attacker can then leverage to create a new administrative account, effectively leading to full site takeover.\nThis vulnerability is strictly unauthenticated, requiring no prior knowledge of credentials or administrative privileges, provided the site configuration permits public form visibility. The exploit is platform-agnostic concerning the underlying OS, provided the filesystem permissions permit the web server process to delete the specified files.\nPost-exploitation, the attacker has achieved unauthorized file destruction, leading to a Denial of Service (DoS) of the web application or, more critically, a gateway to Remote Code Execution via subsequent configuration re-initialization."
}