CVE-2026-15606: WordPress Frontend Admin Auth Bypass Flaw

CVE-2026-15606 Overview

CVE-2026-15606 is an authorization bypass vulnerability in the Frontend Admin by DynamiApps plugin for WordPress, affecting all versions up to and including 3.29.9. The plugin fails to properly verify that a user is authorized to perform a password reset action. Authenticated attackers with subscriber-level or higher permissions can reset the password of any user on the site, including administrators. Successful exploitation results in full account takeover and complete site compromise. The flaw is tracked as CWE-862: Missing Authorization.

Critical Impact
A low-privileged authenticated attacker can reset any administrator's password and take over the WordPress site by forging an encrypted Current-User token using CBC bit-flipping.

Affected Products

Frontend Admin by DynamiApps plugin for WordPress
All versions up to and including 3.29.9
WordPress sites where the plugin exposes any Edit User form to authenticated users

Discovery Timeline

2026-08-11 - CVE-2026-15606 published to the National Vulnerability Database
2026-08-12 - Last updated in the NVD database

Technical Details for CVE-2026-15606

Vulnerability Analysis

The vulnerability resides in the Frontend Admin plugin's user-editing workflow, which relies on an encrypted Current-User token to identify the target account for updates such as password changes. The plugin trusts this token without performing a server-side authorization check confirming that the requesting user has permission to modify the identified account. As a result, any authenticated user who can legitimately submit an Edit User form for their own account holds a valid encrypted token. That token becomes a known-plaintext base an attacker can manipulate to target other accounts. The affected code paths are visible in the plugin sources for the password field handler, the submit class, and the helpers module.

Root Cause

The root cause is missing authorization combined with an unauthenticated encryption scheme. The plugin uses AES in Cipher Block Chaining (CBC) mode without a Message Authentication Code (MAC) to protect the Current-User token. Because ciphertext integrity is not verified, an attacker who knows the plaintext of one block can flip bits in the preceding ciphertext block to alter the decrypted value of the next block. Without an authorization check on the resulting user identifier, the server accepts the forged token and applies the password change to any specified account.

Attack Vector

Exploitation requires network access and a valid subscriber-level (or higher) account. The attacker first accesses an Edit User form they are legitimately authorized to submit and captures the encrypted Current-User token generated for their own account. Using this token as known-plaintext, the attacker performs a CBC bit-flipping transformation to forge a token that decrypts to an administrator's user identifier. The attacker then submits the password reset request with the forged token, and the plugin overwrites the administrator's password. The attacker logs in as the administrator and gains full control of the site. The fix is shipped in plugin changeset 3633030.

Detection Methods for CVE-2026-15606

Indicators of Compromise

Unexpected password changes for administrator or high-privilege WordPress accounts with no corresponding user request
WordPress wp-admin login events from unfamiliar IP addresses immediately following a POST to the Frontend Admin submit endpoint
Multiple POST requests to Frontend Admin form endpoints from a single low-privileged account within a short timeframe
Newly created administrator accounts, plugin installations, or theme edits following a suspicious form submission

Detection Strategies

Inspect web server access logs for repeated submissions to Frontend Admin form endpoints originating from subscriber-level sessions
Correlate WordPress password reset events with the submitting user's role and session identity to flag privilege mismatches
Alert on any password change where the target user identifier differs from the authenticated session user for Frontend Admin form submissions

Monitoring Recommendations

Enable WordPress audit logging for user profile updates, role changes, and password resets
Monitor authentication logs for administrator logins from IP addresses previously associated with low-privileged accounts
Track installation of new plugins, themes, or administrator accounts as post-exploitation indicators

How to Mitigate CVE-2026-15606

Immediate Actions Required

Update the Frontend Admin by DynamiApps plugin to a version newer than 3.29.9 that includes the fix from changeset 3633030
Force a password reset for all administrator and privileged accounts if the plugin was exposed before patching
Review WordPress user lists and remove any unrecognized administrator accounts
Audit installed plugins and themes for unauthorized additions or file modifications

Patch Information

The vendor released a fix in plugin changeset 3633030 for the acf-frontend-form-element plugin. Additional technical analysis is available in the Wordfence Vulnerability Report. Administrators should upgrade to the patched release through the WordPress plugin dashboard and verify the installed version after the update.

Workarounds

Temporarily deactivate the Frontend Admin by DynamiApps plugin until the patch can be applied
Restrict subscriber and low-privilege account registration on affected sites
Place the WordPress site behind a Web Application Firewall (WAF) with rules that block requests to Frontend Admin form endpoints from non-administrator sessions
Disable frontend Edit User forms if they are not required for site functionality

bash

# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate acf-frontend-form-element

# Verify installed version after update
wp plugin get acf-frontend-form-element --field=version