CVE-2026-19952

Frontend Admin by DynamiApps, a WordPress plugin for building front-end forms, is vulnerable to arbitrary file deletion caused by insufficient file path validation (path traversal, CWE-22) in its move_folders function, affecting all versions up to and including 3.29.12. The flaw is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), because the security nonce required for the request is publicly obtainable from the rendered form. An unauthenticated attacker can delete arbitrary files on the web server, which can easily lead to remote code execution when a critical file such as wp-config.php is deleted. Any WordPress site running the plugin at version 3.29.12 or earlier is affected, with the unauthenticated attack path available wherever at least one form is publicly accessible. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS assigns a 0.8% (54th percentile) probability of exploitation within 30 days.

What to do: Upgrade Frontend Admin to a version later than 3.29.12 as soon as a patched release is available. Until then, audit the plugin's forms for public visibility (who_can_see='all'), switch them to require authentication or deactivate the plugin, and consider a WAF rule blocking path-traversal sequences in move_folders requests. Administrators should also verify the integrity of critical files such as wp-config.php, since deletion of such files can result in full site compromise.