Read the docs
TI-2026-05465 Aliases CVE-2026-6228GHSA-g3qj-jqcf-jg78

Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

Priority MEDIUM 40CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shabtiFrontend Admin by DynamiAppsup to 3.28.36—No fix listedCNA
  • Frontend Admin by DynamiApps Vendorshabti Affected up to 3.28.36 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dynamiapps:frontend_admin:*:*:*:*:*:*:*:*——shabti
  • cpe:2.3:a:dynamiapps:frontend_admin:*:*:*:*:*:*:*:* Versions — — ·shabti

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6228
  2. 2026-10-03 Alias added: GHSA-g3qj-jqcf-jg78
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 5

  • TI-2025-12196 Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update CVSS 3.1CRITICAL 9.8
  • TI-2026-53069 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier CVSS 3.1CRITICAL 9.8
  • TI-2026-15147 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter CVSS 3.1CRITICAL 9.8
  • TI-2025-13454 Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field CVSS 3.1CRITICAL 9.8
  • TI-2024-03475 Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation CVSS 3.1CRITICAL 9.8
  • TI-2025-13459 Missing authorization in shabti Frontend Admin by DynamiApps CVSS 3.1CRITICAL 9.1
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences