CVE-2026-75816: WordPress Frontend Admin Auth Bypass

CVE-2026-75816 is an authentication bypass flaw in the Frontend Admin by DynamiApps WordPress plugin allowing account takeover. Unauthenticated attackers can modify user email addresses to reset passwords and gain control. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-75816 Overview

CVE-2026-75816 is an authentication bypass vulnerability in the Frontend Admin by DynamiApps plugin for WordPress affecting all versions up to and including 3.29.12. The flaw allows unauthenticated attackers to overwrite any WordPress user's registered email address, including administrator accounts. Attackers can then trigger the native password-reset flow to fully take over the targeted account. The vulnerability is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can hijack administrator accounts on any WordPress site running a vulnerable version of the Frontend Admin plugin, leading to full site compromise.

Affected Products

Frontend Admin by DynamiApps plugin for WordPress
All versions up to and including 3.29.12
WordPress sites with the acf-frontend-form-element plugin installed and active

Discovery Timeline

2026-09-06 - CVE-2026-75816 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75816

Vulnerability Analysis

The vulnerability resides in the plugin's frontend form submission handler. Two separate defects combine to produce an unauthenticated account takeover primitive. The pre_update_value function processes submitted field values without performing any capability or ownership check on the target record. Simultaneously, ActionPost::conditions_logic() short-circuits its current_user_can('edit_post') authorization gate whenever the submitted post ID is non-numeric.

Because the plugin overloads its post-form pipeline to also service user-profile fields, a string identifier such as user_1 is accepted as a valid target. That value bypasses the capability check entirely and routes the write to WordPress user record ID 1, which is typically the primary administrator.

Root Cause

The root cause is a missing authorization check ([CWE-287]) combined with a type-confusion logic flaw. The authorization gate assumes numeric post IDs and treats non-numeric input as an implicit signal to skip validation. The pre_update_value path never re-validates the caller's permission to modify the resolved user object, so the write proceeds without restriction.

Attack Vector

An unauthenticated attacker submits a crafted frontend form request that targets a user record identifier such as user_1 instead of a numeric post ID. The attacker supplies a new email address value for the user_email field. The plugin routes the write to the specified WordPress user without checking capability or ownership. The attacker then requests a WordPress password reset for that account. The reset link is delivered to the attacker-controlled email address, completing the takeover.

See the technical references for the affected code paths: class-user-email.php line 127 and post.php line 1001.

Detection Methods for CVE-2026-75816

Indicators of Compromise

Unexpected changes to the user_email field on administrator or privileged accounts in wp_users.
WordPress password-reset emails delivered to unfamiliar external addresses shortly after anonymous form POSTs.
HTTP POST requests to plugin form endpoints containing non-numeric target IDs such as user_1, user_2, or similar string prefixes.
New administrator sessions originating from IP addresses with no prior authentication history.

Detection Strategies

Inspect web server access logs for POST requests to acf-frontend-form-element action endpoints where form parameters contain user_ prefixed identifiers.
Compare current user_email values in the database against historical backups to identify unauthorized modifications.
Alert on WordPress retrieve_password events immediately followed by successful administrator logins from new IP addresses.

Monitoring Recommendations

Enable WordPress audit logging for user profile changes, especially user_email and user_pass fields for role administrator.
Monitor outbound mail queues for password-reset messages sent to domains not associated with staff accounts.
Deploy a web application firewall rule to flag anonymous submissions to frontend form endpoints that reference user identifiers.

How to Mitigate CVE-2026-75816

Immediate Actions Required

Update the Frontend Admin by DynamiApps plugin to the version released in changeset 3664865 or later.
Audit all administrator accounts for unauthorized email address changes and restore correct values from backup where needed.
Force a password reset for all privileged users and invalidate active sessions.
Review WordPress activity logs for evidence of password-reset requests targeting administrator accounts.

Patch Information

The vendor addressed the vulnerability in the plugin's Subversion repository via changeset 3664865. The fix enforces capability and ownership checks in the affected form-submission code paths. Details are also tracked in the Wordfence Vulnerability Advisory F1637A3B.

Workarounds

Deactivate and remove the Frontend Admin by DynamiApps plugin until the patched version can be installed.
Restrict access to plugin form endpoints using web server access controls or a WAF until patched.
Require two-factor authentication for all administrator accounts to reduce the impact of an email-based password reset takeover.

bash

# Example WAF rule concept: block anonymous submissions referencing user_ identifiers
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1075816,msg:'Block CVE-2026-75816 exploitation attempt'"
  SecRule REQUEST_URI "@contains acf-frontend-form-element" \
    "chain"
    SecRule ARGS "@rx ^user_[0-9]+$" "t:none"