CVE-2026-19952 — WordPress

WordPress — Frontend Admin by DynamiApps 3.29.12 — DynamiApps

WordPress용 Frontend Admin by DynamiApps 플러그인은 3.29.12 이하 모든 버전의 move_folders 함수에서 파일 경로 검증이 불충분하여 임의 파일 삭제에 취약합니다. 이로 인해 인증되지 않은 공격자가 서버의 임의 파일을 삭제할 수 있으며, 적절한 파일(예: wp-config.php)이 삭제될 경우 원격 코드 실행으로 쉽게 이어질 수 있습니다. 이는 폼이 공개 가시성(who_can_see='all')으로 구성된 경우 인증 없이 악용 가능하며, 필요한 nonce는 렌더링된 폼에서 공개적으로 획득할 수 있습니다.

# CVE-2026-19952 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-19952` - CWE: CWE-22 - published: 2026-09-01T05:17:09.747 ## NVD description The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form. ## MITRE description error: <urlopen error [Errno 8] nodename nor servname provided, or not known> ## Affected ## References (JSON sources only) - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1014 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1044 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/general/class-upload-file.php#L1047 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L125 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L276 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.13/main/frontend/fields/general/class-upload-file.php#L1047 - https://www.wordfence.com/threat-intel/vulnerabilities/id/55ec5101-6494-4180-9492-03863e839ad2?source=cve - https://github.com/advisories/GHSA-3rrx-59q7-9g4m - https://nvd.nist.gov/vuln/detail/CVE-2026-19952 ## GitHub advisory The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion... The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.

CVE	CVE-2026-19952 · CVE.org
CWE	CWE-22
CVSS	High: 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
Product	WordPress — Frontend Admin by DynamiApps
Affected	3.29.12 이하 모든 버전(포함)
Patched	3.29.13 이상
Auth	없음 (소스 맵 참조)
License	GNU Affero GPL v3.0
Lab	`127.0.0.1` 전용 · 벤더/클라이언트 공개 패키지, 스캐너 아님

CVE-2026-19952

인기

권고 (소스 맵 기준)

진입점

호출 체인

랩 사전 조건

증거(Witness)

성공이 아닌 경우

패치 / 완화

재현 (승인된 랩)

랩 이미지

참조

레코드 (구조화)

라이선스

면책 조항