CVE-2026-19952 — WordPress

WordPress — Frontend Admin by DynamiApps 3.29.12 — DynamiApps

WordPress 用プラグイン Frontend Admin by DynamiApps は、move_folders 関数におけるファイルパス検証の不備により、任意のファイル削除が可能です。これは 3.29.12 を含むすべてのバージョンに影響します。これにより、認証されていない攻撃者がサーバー上の任意のファイルを削除できる可能性があり、削除するファイルによっては (wp-config.php など) リモートコード実行につながる可能性があります。フォームが公開表示 (who_can_see='all') で設定されている場合、必要な nonce がレンダリングされたフォームから公開的に取得できるため、認証なしで悪用可能です。

# CVE-2026-19952 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-19952` - CWE: CWE-22 - published: 2026-09-01T05:17:09.747 ## NVD description The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form. ## MITRE description error: <urlopen error [Errno 8] nodename nor servname provided, or not known> ## Affected ## References (JSON sources only) - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1014 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1044 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1047 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L125 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L276 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.13/main/frontend/fields/general/class-upload-file.php#L1047 - https://www.wordfence.com/threat-intel/vulnerabilities/id/55ec5101-6494-4180-9492-03863e839ad2?source=cve - https://github.com/advisories/GHSA-3rrx-59q7-9g4m - https://nvd.nist.gov/vuln/detail/CVE-2026-19952 ## GitHub advisory The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion... The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.

CVE	CVE-2026-19952 · CVE.org
CWE	CWE-22
CVSS	High: 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
Product	WordPress — Frontend Admin by DynamiApps
Affected	3.29.12 までのすべてのバージョン (含む)
Patched	3.29.13 以降
Auth	なし (ソースマップを参照)
License	GNU Affero GPL v3.0
Lab	`127.0.0.1` のみ · ベンダー/クライアント開示パックであり、スキャナーではありません

CVE-2026-19952

人気

アドバイザリ (ソースマップより)

エントリ

コールチェーン

ラボの前提条件

証拠

成功ではないもの

パッチ / 修復

再現 (許可されたラボ)

ラボイメージ

参考文献

レコード (構造化)

ライセンス

免責事項