CVE-2026-19952 — WordPress

WordPress — Frontend Admin by DynamiApps 3.29.12 — DynamiApps

إن إضافة Frontend Admin by DynamiApps الخاصة بـ WordPress معرّضة لحذف ملفات عشوائية بسبب عدم كفاية التحقق من مسار الملف في الدالة move_folders في جميع الإصدارات حتى الإصدار 3.29.12 ضمناً. وهذا يتيح للمهاجمين غير المصادق عليهم حذف ملفات عشوائية على الخادم، مما قد يؤدي بسهولة إلى تنفيذ تعليمات برمجية عن بُعد عند حذف الملف المناسب (مثل wp-config.php). وهذا قابل للاستغلال دون مصادقة عندما يتم إعداد نموذج بظهور عام (who_can_see='all')، حيث يمكن الحصول على الـ nonce المطلوب علناً من النموذج المعروض.

# CVE-2026-19952 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-19952` - CWE: CWE-22 - published: 2026-09-01T05:17:09.747 ## NVD description The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form. ## MITRE description error: <urlopen error [Errno 8] nodename nor servname provided, or not known> ## Affected ## References (JSON sources only) - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1014 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1044 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1047 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L125 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L276 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.13/main/frontend/fields/general/class-upload-file.php#L1047 - https://www.wordfence.com/threat-intel/vulnerabilities/id/55ec5101-6494-4180-9492-03863e839ad2?source=cve - https://github.com/advisories/GHSA-3rrx-59q7-9g4m - https://nvd.nist.gov/vuln/detail/CVE-2026-19952 ## GitHub advisory The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion... The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.

CVE	CVE-2026-19952 · CVE.org
CWE	CWE-22
CVSS	High: 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
Product	WordPress — Frontend Admin by DynamiApps
Affected	جميع الإصدارات حتى 3.29.12 (ضمناً)
Patched	3.29.13 وما بعده
Auth	لا شيء (انظر خريطة المصدر)
License	GNU Affero GPL v3.0
Lab	`127.0.0.1` فقط · حزمة إفصاح للمورّد/العميل، وليست أداة فحص

CVE-2026-19952

الأكثر شعبية

الإشعار (من خريطة المصدر)

المدخل

سلسلة الاستدعاء

الشروط المسبقة للمختبر

الدليل

ليس نجاحاً

الترقيع / المعالجة

إعادة الإنتاج (مختبر مصرّح به)

صور المختبر

المراجع

السجلات (منظمة)

الترخيص

إخلاء المسؤولية