Description

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-04T07:17:10.547Z",
  "pubdate": "2026-09-04T07:17:10.547Z",
  "executiveSummary": "The Frontend Admin WordPress plugin, in versions prior to 3.29.13, contains a critical vulnerability involving improper input validation of directory paths.\nThis vulnerability is classified as an Arbitrary File Deletion flaw, which allows unauthenticated remote attackers to perform unauthorized file system operations.\nBy manipulating directory path parameters, an attacker can traverse beyond the intended scope and delete sensitive files, including critical WordPress core files such as index.php and .htaccess.\nThe successful exploitation of this vulnerability can lead to a complete denial-of-service (DoS) state, effectively taking the WordPress site offline or compromising its core configuration.\nWhile the vulnerability is exploitable by unauthenticated attackers, it requires specific non-default form configurations within the plugin to be active.\nGiven the potential for site-wide disruption, this vulnerability represents a significant security risk, necessitating immediate updates to the patched version of the plugin.",
  "technicalDetails": "The vulnerability resides in the core file processing logic of the Frontend Admin plugin, specifically within the functions responsible for managing user-submitted file handling.\nThe root cause is a lack of sufficient sanitization and canonicalization of user-supplied directory paths during the file deletion process. The application accepts a user-controlled path parameter and fails to perform adequate boundary checking to ensure that the requested deletion path remains restricted to a pre-defined, safe directory.\nExploitation is achieved through a directory traversal technique. By supplying a specially crafted file path—likely utilizing dot-dot-slash (../) sequences—an attacker can bypass security constraints to target sensitive files located outside the plugin's designated directory.\nThe attack flow proceeds as follows: First, the attacker identifies a form managed by Frontend Admin that is configured to handle file interactions. Second, the attacker intercepts the request responsible for triggering the deletion action. Third, the attacker injects the malicious traversal payload into the directory path parameter. Finally, the server-side code, failing to validate the path, executes a system-level deletion command against the target file specified by the attacker.\nBecause the web server process typically runs with the permissions of the web user, it possesses sufficient authorization to delete critical files located in the web root, such as index.php or .htaccess, provided those files are writable by the web server user.\nThis vulnerability is particularly dangerous because it does not require authentication, allowing any remote visitor to trigger the deletion logic if the non-default form configuration exists. The impact is immediate and severe, as deleting the index.php file breaks the application's entry point, and deleting .htaccess disrupts essential URL rewriting and security configurations, resulting in a site-wide crash.\nAffected versions are strictly limited to those identified as being before 3.29.13. Post-exploitation, the lack of these critical configuration and bootstrap files prevents the WordPress environment from initializing, forcing manual recovery by an administrator to restore the deleted files from backups."
}