CVE-2026-19952: Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

Q: Which deployments are exposed to unauthenticated exploitation?

Deployments are exposed when they run a vulnerable version through 3.29.12 and have a form configured with public visibility (who_can_see='all'). In that configuration, an unauthenticated attacker can obtain the required nonce from the rendered form.

Q: What does an attacker need to exploit this issue?

The attacker needs network access to a publicly visible form using the affected plugin. No account, privileges, or user interaction are required.

Q: What is the impact if exploitation succeeds?

An attacker can delete arbitrary files on the server through path traversal in the custom_directory_name merge tag. Deleting certain files, such as wp-config.php, can potentially lead to remote code execution.

Q: What can be done before an update is available or applied?

Remove public access to affected forms by ensuring they are not configured with who_can_see='all'. This prevents unauthenticated attackers from obtaining the nonce from a rendered public form.

Published Sep 1, 2026

Updated

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (whocansee='all'), as the required nonce is publicly obtainable from the rendered form.

Affected Software

1 affected component

Frontend Admin<=3.29.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/plugin/Frontend Admin by DynamiApps to a version that resolves this vulnerability.
Fixed in 3.29.12
Compensating control
If you must keep the plugin enabled, ensure any forms that use Frontend Admin by DynamiApps are not publicly visible (do not set who_can_see='all'), since exploitation is possible without authentication for public forms.

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Deployments are exposed when they run a vulnerable version through 3.29.12 and have a form configured with public visibility (who_can_see='all'). In that configuration, an unauthenticated attacker can obtain the required nonce from the rendered form.

What does an attacker need to exploit this issue?

The attacker needs network access to a publicly visible form using the affected plugin. No account, privileges, or user interaction are required.

What is the impact if exploitation succeeds?

An attacker can delete arbitrary files on the server through path traversal in the custom_directory_name merge tag. Deleting certain files, such as wp-config.php, can potentially lead to remote code execution.

What can be done before an update is available or applied?

Remove public access to affected forms by ensuring they are not configured with who_can_see='all'. This prevents unauthenticated attackers from obtaining the nonce from a rendered public form.

CVE-2026-19952: Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

What can be done before an update is available or applied?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

What can be done before an update is available or applied?