CVE-2026-19952 Overview
CVE-2026-19952 affects the Frontend Admin by DynamiApps plugin for WordPress in all versions up to and including 3.29.12. The vulnerability resides in the move_folders function, which fails to validate file paths properly. Unauthenticated attackers can delete arbitrary files on the server when a form is configured with public visibility (who_can_see='all'), because the required nonce is publicly obtainable from the rendered form. Deleting sensitive files such as wp-config.php can lead to remote code execution by forcing WordPress into a re-installation state. The flaw is classified as a path traversal issue [CWE-22].
Critical Impact
Unauthenticated attackers can delete arbitrary files on the server, including wp-config.php, enabling site takeover through subsequent remote code execution.
Affected Products
- Frontend Admin by DynamiApps plugin for WordPress — all versions up to and including 3.29.12
- Fixed in version 3.29.13
- WordPress sites using the plugin with forms configured as publicly visible (who_can_see='all')
Discovery Timeline
- 2026-09-01 - CVE-2026-19952 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-19952
Vulnerability Analysis
The Frontend Admin by DynamiApps plugin exposes file management functionality through the move_folders function within its Advanced Custom Fields (ACF) frontend form component. The function accepts user-supplied file path parameters without applying path canonicalization or restricting operations to a safe base directory. Attackers can supply crafted paths that traverse outside the intended upload directory and target arbitrary files on the filesystem.
The issue is reachable without authentication when a form is rendered with who_can_see='all'. The nonce required by the submission endpoint is embedded directly in the public form output, so any unauthenticated visitor can retrieve it and issue a valid request. This turns a nonce-protected action into a fully unauthenticated primitive.
Deleting wp-config.php is particularly impactful. Once removed, WordPress reverts to its installation flow, allowing an attacker to reconfigure the site against an attacker-controlled database and achieve code execution through the resulting administrative session.
Root Cause
The root cause is insufficient file path validation in move_folders. The function trusts client-supplied paths and does not enforce that the resolved path stays within an approved directory. Combined with the public exposure of the anti-CSRF nonce through the rendered form, authentication and authorization controls are effectively bypassed.
Attack Vector
Exploitation occurs over the network against any WordPress site running an affected plugin version with at least one publicly visible form. The attacker fetches the page hosting the form, extracts the nonce from the HTML, and issues a POST request to the plugin's submission endpoint invoking move_folders with a traversal payload targeting the desired file. Refer to the Wordfence Vulnerability Analysis and the vendor code references in the WordPress plugin repository for the vulnerable code paths.
Detection Methods for CVE-2026-19952
Indicators of Compromise
- Unexpected absence of wp-config.php or other core WordPress files, or the site reverting to the installation wizard.
- POST requests to admin-ajax.php or plugin submission endpoints referencing the move_folders action with path traversal sequences such as ../ in parameters.
- Web server logs showing unauthenticated requests to pages containing ACF frontend forms immediately followed by plugin submission POSTs.
Detection Strategies
- Inventory WordPress installations and identify sites running the Frontend Admin by DynamiApps plugin at version 3.29.12 or earlier.
- Deploy web application firewall rules that block traversal patterns in parameters targeting the plugin's AJAX handlers.
- Monitor file integrity of wp-config.php, .htaccess, and core wp-includes files to identify deletions.
Monitoring Recommendations
- Alert on HTTP 500 errors or WordPress installation redirects that follow requests to plugin form endpoints.
- Correlate outbound requests from the web server with recent modifications or deletions in the WordPress document root.
- Retain full HTTP request bodies for the plugin's AJAX endpoints to enable retrospective hunting.
How to Mitigate CVE-2026-19952
Immediate Actions Required
- Update the Frontend Admin by DynamiApps plugin to version 3.29.13 or later on every affected WordPress site.
- Audit all forms created with the plugin and restrict who_can_see to authenticated roles until patching is complete.
- Verify the integrity of wp-config.php and other sensitive files, and restore from backup if tampering is suspected.
Patch Information
The vendor addressed the vulnerability in version 3.29.13 of the plugin. The corrected file path handling can be reviewed in the patched upload-file class. Apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Temporarily deactivate the Frontend Admin by DynamiApps plugin until the update is applied.
- Reconfigure every form to require authentication by setting who_can_see to a specific role instead of all.
- Deploy WAF rules that reject requests to the plugin's endpoints containing ../ or absolute paths in file parameters.
# Update the plugin using WP-CLI
wp plugin update acf-frontend-form-element --version=3.29.13
# Verify installed version
wp plugin get acf-frontend-form-element --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
