Authorization Bypass in Frontend Admin WordPress Plugin

The Frontend Admin plugin for WordPress, developed by DynamiApps, contains an authorization bypass vulnerability (CVE-2026-15606) affecting all versions up to and including 3.29.9. The flaw stems from insufficient verification of user permissions during administrative actions. By exploiting this, an authenticated attacker with at least subscriber-level access can manipulate the application's CBC-encrypted tokens. Specifically, the attacker can perform a CBC bit-flipping attack using a legitimate Current-User token obtained from an authorized Edit User form. This allows the attacker to forge a request to reset the password of any user, including administrators, leading to unauthorized account takeover and complete site compromise. Given the prevalence of WordPress site management plugins, this vulnerability poses a significant risk to site integrity and administrative control.

Attack Chain

1. Attacker authenticates to the target WordPress site with a standard subscriber-level account.
2. Attacker navigates to a legitimate Edit User form that they are authorized to submit.
3. Attacker intercepts the valid Current-User token generated by the Frontend Admin plugin.
4. Attacker analyzes the intercepted token to serve as a known-plaintext base for a CBC bit-flipping attack.
5. Attacker applies bit-flipping techniques to the token to manipulate the authorization state for privileged actions.
6. Attacker submits a forged request using the modified token to the password reset endpoint.
7. The plugin processes the forged request, successfully resetting the targeted administrator's password.
8. Attacker logs into the site using the newly set administrator credentials to achieve full site control.

Impact

Successful exploitation of CVE-2026-15606 allows an attacker to reset the passwords of any registered user, including site administrators. This results in full account takeover, granting the attacker unrestricted administrative access to the WordPress environment. This impact encompasses the potential for exfiltration of sensitive data, deployment of malicious backdoors, and total site compromise.

Recommendation

• Update the "Frontend Admin" plugin to the latest available version beyond 3.29.9 immediately to patch CVE-2026-15606.
• Audit WordPress administrative user logs for unexpected password reset events or suspicious account modification activity.
• Implement strict least-privilege access for user roles to minimize the exposure of administrative forms to low-privileged users.
• Monitor webserver logs for high volumes of POST requests to user management endpoints emanating from authenticated low-privileged accounts.