abraxas/cve-2026-75816Prueba de concepto y reproducción en laboratorio para CVE-2026-75816, una toma de control de cuenta no autenticada de WordPress Frontend Admin mediante el envío de formularios a admin-ajax.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-75816
Frontend Admin by DynamiApps 3.29.11 — shabti
El plugin Frontend Admin by DynamiApps para WordPress es vulnerable a Authentication Bypass to Account Takeover en todas las versiones hasta la 3.29.12, inclusive. Esto se debe a que la función pre_update_value carece de cualquier comprobación de capacidad o propiedad, y ActionPost::conditions_logic() cortocircuita su puerta de autorización current_user_can('edit_post') siempre que el ID del post no sea numérico — como la cadena user_1 — permitiendo que los envíos de formularios no autenticados se enruten a registros de usuario arbitrarios sin restricción. Esto hace posible que atacantes no autenticados sobrescriban la dirección de correo electrónico registrada de cualquier usuario, incluida la de un administrador, y luego aprovechen el flujo nativo de restablecimiento de contraseña de WordPress para tomar el control total de la cuenta objetivo.
| CVE | CVE-2026-75816 · CVE.org |
| CWE | CWE-287 |
| CVSS | Critical: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | Frontend Admin by DynamiApps |
| Affected | todas las versiones hasta la 3.29.11 (NVD lista la 3.29.12; la 3.29.12 añadió la comprobación edit_user del campo Email) |
| Patched | 3.29.12 y posteriores |
| Auth | ninguna (ver mapa de código fuente) |
| License | GNU Affero GPL v3.0 |
| Lab | solo 127.0.0.1 · paquete de divulgación para el proveedor/cliente, no un escáner |
pre_update_value es el sink, no una acción ajax= con ese nombre. El HTTP es admin-ajax.php action=frontend_admin/form_submit. El id del objeto es user_1 en _acf_objects, no un id de post numérico.
POST/wp-admin/admin-ajax.phpGET /fea-lab/ harvest _acf_form _acf_nonce _acf_objects field keyPOST /wp-admin/admin-ajax.php action=frontend_admin/form_submit acff[post][field][email protected]check_submit_form nopriv + who_can_see=allget_form_data fea_decrypt(_acf_objects) record[post]=user_1ActionPost::conditions_logic !is_numeric(user_1) skip edit_postActionPost::run metas acf_update_value value, user_1, user_email fielduser_email::pre_update_value explode user_ wp_update_user ID=1 [email protected]GET /?fea_lab_email=1 body is that addressGET /?fea_lab_email=1 el cuerpo es [email protected]. HTML de formulario genérico o [email protected] no lo es.
Haz esto primero: Actualiza Frontend Admin by DynamiApps a 3.29.12 o posterior (la actual es 3.29.13).
Verificar tras la actualización
CVE-2026-75816-Abraxas-Labs.py contra la compilación parcheada: el testigo mapeado no debe aparecer.Si no puedes actualizar de inmediato
Apunta solo a http://127.0.0.1:8088 (o al loopback que hayas enlazado). No apuntes este script a internet.
python3 CVE-2026-75816-Abraxas-Labs.py
El éxito es el testigo anterior en el cuerpo de la respuesta. Un 200 HTML genérico no lo es.
Stack de loopback usado para reproducir. Imágenes oficiales a menos que un Dockerfile en esta carpeta compile desde el código fuente.
cd lab
docker compose up --force-recreate
Enlaza el árbol del producto vulnerable junto a Compose si el YAML monta un directorio local (zip del plugin / etiqueta de código fuente de la tabla de versiones). No publiques nada excepto 127.0.0.1.
plugins.trac.wordpress.org/changeset/3664865/acf-frontend-form-element
www.wordfence.com/threat-intel/vulnerabilities/id/f1637a3b-7b0f-485d-9d19-4f711f8c671b?source=cve
Directorio de plugins: acf-frontend-form-element
Navegador Trac: plugins.trac.wordpress.org/acf-frontend-form-element
Etiquetas SVN: plugins.svn.wordpress.org/acf-frontend-form-element
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-75816 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-75816`
- CWE: CWE-287
- published: 2026-09-06T03:17:16.607
## NVD description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
## MITRE description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
## Affected
- shabti Frontend Admin by DynamiApps 0 affected
## References (JSON sources only)
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/user/class-user-email.php#L127
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/actions/post.php#L1001
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/actions/post.php#L1224
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/display.php#L26
- https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L125
- https://plugins.trac.wordpress.org/changeset/3664865/acf-frontend-form-element
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f1637a3b-7b0f-485d-9d19-4f711f8c671b?source=cve
- https://github.com/advisories/GHSA-pv54-wq7v-wf7v
- https://nvd.nist.gov/vuln/detail/CVE-2026-75816
## GitHub advisory
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to...
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
Este paquete de divulgación está licenciado bajo la GNU Affero General Public License v3.0. Ver LICENSE.
Este paquete es para el proveedor, el propietario del sitio y los labs autorizados. El script se comunica con 127.0.0.1. Usarlo contra sistemas que no posees no está autorizado por Abraxas Labs. Sin garantía.