CVE-2026-10039: WordPress Frontend Admin SQLi Vulnerability

CVE-2026-10039 Overview

CVE-2026-10039 is a SQL injection vulnerability in the Frontend Admin by DynamiApps plugin for WordPress. The flaw affects all versions up to and including 3.28.28 and resides in the order parameter handling within the plugin's payments list page. Insufficient escaping of user-supplied input and lack of safe query preparation allow authenticated attackers with administrator-level access to append arbitrary SQL clauses to existing queries. Exploitation requires the attacker to supply a valid orderby parameter in the same request to reach the vulnerable code path. Successful exploitation can extract sensitive information from the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated administrators can extract sensitive database contents through SQL clause injection via the order request parameter.

Affected Products

• Frontend Admin by DynamiApps (plugin slug acf-frontend-form-element) — all versions up to and including 3.28.28
• WordPress sites running the vulnerable plugin with administrator accounts available to attackers
• Patched in plugin release 3.29.3

Discovery Timeline

• 2026-05-29 - CVE-2026-10039 published to NVD
• 2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-10039

Vulnerability Analysis

The vulnerability is a generic SQL injection in the plugin's payments administration list view. The affected code is referenced at lines 45 and 46 of main/admin/admin-pages/payments/list.php in the plugin source tree. When the page builds its SQL query to enumerate payment records, it concatenates the order HTTP parameter directly into the query without escaping or parameterization. The orderby parameter must also be supplied with a valid value, because the conditional logic that processes order is only reached when orderby passes prior checks. Because the injection occurs inside an ORDER BY clause, attackers can leverage techniques such as subqueries, conditional expressions, or UNION-style stacking depending on database support to read arbitrary table contents, including user records and authentication metadata.

Root Cause

The root cause is failure to sanitize the order parameter and failure to use prepared statements via the WordPress $wpdb->prepare() API. The query string is assembled through direct concatenation, so any text supplied for order becomes part of the executed SQL.

Attack Vector

Exploitation is remote and network-based but requires authenticated administrator privileges. An attacker submits a crafted HTTP request to the payments listing page with a benign-looking orderby value and a malicious order value carrying additional SQL syntax. The injected SQL executes in the WordPress database context, returning data through error channels, timing, or response content.

No verified proof-of-concept code is published. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin List.php Reference.

Detection Methods for CVE-2026-10039

Indicators of Compromise

• HTTP requests to WordPress admin pages containing orderby and order parameters where order includes SQL syntax such as SELECT, UNION, SLEEP(, BENCHMARK(, parentheses, or commas instead of the expected ASC/DESC values.
• Unexpected wpdb query errors in WordPress debug logs referencing ORDER BY clauses on payment-related tables.
• Administrator sessions issuing repeated requests to the Frontend Admin payments list with varying order payloads.

Detection Strategies

• Inspect web server and WordPress access logs for order parameter values that deviate from ASC or DESC.
• Deploy a web application firewall rule that validates the order parameter against an allowlist of expected sort directions.
• Correlate administrator authentication events with bursts of requests to admin-pages/payments/list.php to identify suspicious enumeration behavior.

Monitoring Recommendations

• Enable database query logging on the WordPress MySQL or MariaDB backend and alert on malformed ORDER BY clauses.
• Monitor for newly created or recently elevated administrator accounts that interact with the Frontend Admin plugin.
• Track outbound data volumes from the database tier to detect bulk extraction following injection attempts.

How to Mitigate CVE-2026-10039

Immediate Actions Required

• Update the Frontend Admin by DynamiApps plugin to version 3.29.3 or later on every WordPress site where it is installed.
• Audit all WordPress administrator accounts, remove unused accounts, and reset credentials for any account suspected of compromise.
• Review recent database access logs for evidence of injection attempts against the order parameter.

Patch Information

The vendor addressed the issue in plugin version 3.29.3. The fix is visible in the WordPress Changeset Overview and the patched source in main/admin/admin-pages/payments/list.php. Upgrading the plugin through the WordPress admin dashboard or via wp-cli applies the fix.

Workarounds

• If immediate patching is not possible, disable the Frontend Admin by DynamiApps plugin until the upgrade can be applied.
• Restrict administrator access using IP allowlisting at the web server or WAF tier to limit who can reach the vulnerable endpoint.
• Add a WAF rule that rejects requests where the order query parameter is not equal to asc, desc, ASC, or DESC.

# Update the plugin using wp-cli
wp plugin update acf-frontend-form-element --version=3.29.3

# Verify installed version
wp plugin get acf-frontend-form-element --field=version