CVE-2026-19952highCWE-22

CVE-2026-19952: falha de alta gravidade em shabti Frontend Admin by DynamiApps

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag

Publicada em

Seguir esta CVE+ Monitorar Frontend Admin by DynamiApps

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7.5epss 1.2%
da publicação à arma18 dias
Publicada no NVD1 de set.
1ª PoC+18d
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
shabti · Frontend Admin by DynamiApps
PoCs públicas encontradas — 1
githubgithub.com/abraxas/CVE-2026-19952★ 0
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — shabti Frontend Admin by DynamiApps

No mesmo produto, das mais perigosas para as menos.

CVE-2025-13342CRITICALFrontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options UpdateEPSS 2.3%CVE-2026-75816CRITICALFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object IdentifierEPSS 0.9%CVE-2026-18432CRITICALFrontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' ParameterEPSS 0.8%CVE-2024-3729CRITICALFrontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form ManipulationEPSS 0.8%CVE-2026-6226HIGHFrontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration InjectionEPSS 0.7%CVE-2025-14736CRITICALFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form FieldEPSS 0.7%