Blog Unauth admin takeover in Frontend Admin, patched in 3.29.10
Unauth admin takeover in Frontend Admin, patched in 3.29.10
A missing capability check in Frontend Admin by DynamiApps lets unauthenticated visitors escalate to administrator through a non-numeric user ID; update to 3.29.10 and audit accounts before other criticals in ProSolution WP Client, Solace Extra and ARForms.
The pattern across four critical WordPress plugin advisories is authorization missing, bypassed, or forgotten. Frontend Admin by DynamiApps let unauthenticated visitors reach an administrator role through a non-numeric user ID that skipped the capability check. Solace Extra registered an admin-only import handler on the unauthenticated AJAX endpoint. ProSolution WP Client trusted a filename that arrived in a Content-Disposition header. ARForms deserialized whatever a contact form submitted.
Three of the four have fixes; one does not. The one that doesn’t is also the loudest on paper — a 9.8 pre-auth PHP object injection — but the NVD write-up is clear that no known POP chain reaches the vulnerable class, so the practical risk depends on what else is loaded next to it. Update where you can, and treat the unpatched one as a reason to remove the plugin from any site you cannot afford to lose.
acf-frontend-form-element 3.29.10
ActionUser::conditions_logic() runs current_user_can('edit_user', $user_id) only when is_numeric($user_id) returns true. A string like admin is not numeric, so the gate never fires and the code beneath it edits the user anyway. The result is a pre-auth path to administrator on any site running Frontend Admin by DynamiApps at 3.29.9 or older.
- Affected: all versions up to and including 3.29.9
- Patched: 3.29.10
- CVE-2026-18432, CVSS 9.8
- After updating, audit
wp_usersfor accounts created since early August and check that no existing account has been quietly promoted
prosolution-wp-client 2.0.11
Two critical bugs in the same plugin, both patched in the same release. The first (CVE-2026-16098, 9.8) is arbitrary file upload: proSol_handleFileUpload treated the filename from the Content-Disposition header as authoritative and let it override the allow-listed multipart filename before writing to disk, and the post-save extension check failed to delete what it rejected. The second (CVE-2026-14524, 9.1) is arbitrary file deletion in proSol_fileDeleteProcess, reachable from the frontend and enough to remove wp-config.php — a common bridge to remote code execution on the reinstall attempt.
- Affected: upload up to 2.0.10, deletion up to 2.0.8
- Patched: 2.0.11
- Look for unfamiliar files in the plugin’s upload target and for a missing or truncated
wp-config.php
solace-extra 1.6.2
The import_zip() handler was registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip, so it accepted requests from logged-out visitors as well as any Subscriber-level account. The only gate was an ajax-nonce value that Solace Extra emits on every admin page through wp_localize_script, which turns the nonce into a public token rather than a secret. A caller who can read one admin page — or one Subscriber who logs in — can wipe menus and widgets across the entire site.
- Affected: all versions up to and including 1.6.0
- Patched: 1.6.2
- CVE-2026-18316, CVSS 9.1
- Compare
wp_optionsmenu and widget rows against a known-good backup; the handler wipes rather than merges
arforms-form-builder up to 1.8.5, unpatched
Contact form submissions are unserialized without a whitelist, so any visitor can inject a PHP object through the form endpoint. NVD notes that the vulnerable code ships without a POP chain, which means exploitation depends on classes loaded by other plugins or themes on the same site. That is a bad property to depend on — the ecosystem around any WordPress install changes constantly. Sites running ARForms should remove it until the vendor ships a fix, and in the meantime scan the filesystem for webshells that a chained gadget might have dropped.
- Affected: all versions up to and including 1.8.5
- Patched: no fix at time of writing
- CVE-2024-13784, CVSS 9.8
For sites that want a scanner built for exactly this kind of plugin compromise — webshells dropped through upload holes, files quietly removed through deletion bugs, tampered plugin source that a hash comparison misses — Segurium is a WordPress malware scanner and cleanup tool available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve , #exploit