[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-18432":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-17T10:37:26.669Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":264,"aliases":265,"duplicate_of":9,"upstream":266,"downstream":267,"duplicates":268,"related":269,"reserved_at":9,"published_at":270,"modified_at":270,"state":271,"summary":272,"references_raw":279,"kevs":329,"epss":9,"epss_history":330,"metrics":331,"affected":338},"CVE-2026-18432","The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-269","Improper Privilege Management","The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","weakness","Draft","Class","Medium",[20,182,260],{"id":21,"name":22,"techniques":23},"CAPEC-122","Privilege Abuse",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1548","Abuse Elevation Control Mechanism",[28,31],{"id":29,"name":30},"TA0030","Defense Evasion",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,45,50,55,59,63,67,72,76,80,84,88,92,96,100,104,109,113,117,121,126,130,134,138,142,146,150,154,158,162,166,170,174,178],{"id":36,"name":37,"tactic":38},"D3-CM","Content Modification",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-AEM","Application Exception Monitoring",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-DF","Decoy File",{"name":49},"Deceive",{"id":51,"name":52,"tactic":53},"D3-CI","Configuration Inventory",{"name":54},"Model",{"id":56,"name":57,"tactic":58},"D3-SCA","System Call Analysis",{"name":44},{"id":60,"name":61,"tactic":62},"D3-SFA","System File Analysis",{"name":44},{"id":64,"name":65,"tactic":66},"D3-FA","File Analysis",{"name":44},{"id":68,"name":69,"tactic":70},"D3-FE","File Encryption",{"name":71},"Harden",{"id":73,"name":74,"tactic":75},"D3-AA","Agent Authentication",{"name":71},{"id":77,"name":78,"tactic":79},"D3-CDP","Change Default Password",{"name":71},{"id":81,"name":82,"tactic":83},"D3-AM","Access Modeling",{"name":54},{"id":85,"name":86,"tactic":87},"D3-DI","Data Inventory",{"name":54},{"id":89,"name":90,"tactic":91},"D3-NTPM","Network Traffic Policy Mapping",{"name":54},{"id":93,"name":94,"tactic":95},"D3-PSA","Process Spawn Analysis",{"name":44},{"id":97,"name":98,"tactic":99},"D3-SCP","System Configuration Permissions",{"name":71},{"id":101,"name":102,"tactic":103},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":105,"name":106,"tactic":107},"D3-RC","Restore Configuration",{"name":108},"Restore",{"id":110,"name":111,"tactic":112},"D3-RF","Restore File",{"name":108},{"id":114,"name":115,"tactic":116},"D3-ULA","Unlock Account",{"name":108},{"id":118,"name":119,"tactic":120},"D3-RUAA","Restore User Account Access",{"name":108},{"id":122,"name":123,"tactic":124},"D3-FEV","File Eviction",{"name":125},"Evict",{"id":127,"name":128,"tactic":129},"D3-RD","Restore Database",{"name":108},{"id":131,"name":132,"tactic":133},"D3-AL","Account Locking",{"name":125},{"id":135,"name":136,"tactic":137},"D3-OPM","Operational Process Monitoring",{"name":44},{"id":139,"name":140,"tactic":141},"D3-DA","Dynamic Analysis",{"name":44},{"id":143,"name":144,"tactic":145},"D3-EFA","Emulated File Analysis",{"name":44},{"id":147,"name":148,"tactic":149},"D3-SCF","System Call Filtering",{"name":39},{"id":151,"name":152,"tactic":153},"D3-CF","Content Filtering",{"name":39},{"id":155,"name":156,"tactic":157},"D3-LFP","Local File Permissions",{"name":39},{"id":159,"name":160,"tactic":161},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":163,"name":164,"tactic":165},"D3-CQ","Content Quarantine",{"name":39},{"id":167,"name":168,"tactic":169},"D3-UAP","User Account Permissions",{"name":39},{"id":171,"name":172,"tactic":173},"D3-HBPI","Hardware-based Process Isolation",{"name":39},{"id":175,"name":176,"tactic":177},"D3-EAL","Executable Allowlisting",{"name":39},{"id":179,"name":180,"tactic":181},"D3-EDL","Executable Denylisting",{"name":39},{"id":183,"name":33,"techniques":184},"CAPEC-233",[185],{"id":25,"name":26,"tactics":186,"countermeasures":189},[187,188],{"id":29,"name":30},{"id":32,"name":33},[190,192,194,196,198,200,202,204,206,208,210,212,214,216,218,220,222,224,226,228,230,232,234,236,238,240,242,244,246,248,250,252,254,256,258],{"id":36,"name":37,"tactic":191},{"name":39},{"id":41,"name":42,"tactic":193},{"name":44},{"id":46,"name":47,"tactic":195},{"name":49},{"id":51,"name":52,"tactic":197},{"name":54},{"id":56,"name":57,"tactic":199},{"name":44},{"id":60,"name":61,"tactic":201},{"name":44},{"id":64,"name":65,"tactic":203},{"name":44},{"id":68,"name":69,"tactic":205},{"name":71},{"id":73,"name":74,"tactic":207},{"name":71},{"id":77,"name":78,"tactic":209},{"name":71},{"id":81,"name":82,"tactic":211},{"name":54},{"id":85,"name":86,"tactic":213},{"name":54},{"id":89,"name":90,"tactic":215},{"name":54},{"id":93,"name":94,"tactic":217},{"name":44},{"id":97,"name":98,"tactic":219},{"name":71},{"id":101,"name":102,"tactic":221},{"name":44},{"id":105,"name":106,"tactic":223},{"name":108},{"id":110,"name":111,"tactic":225},{"name":108},{"id":114,"name":115,"tactic":227},{"name":108},{"id":118,"name":119,"tactic":229},{"name":108},{"id":122,"name":123,"tactic":231},{"name":125},{"id":127,"name":128,"tactic":233},{"name":108},{"id":131,"name":132,"tactic":235},{"name":125},{"id":135,"name":136,"tactic":237},{"name":44},{"id":139,"name":140,"tactic":239},{"name":44},{"id":143,"name":144,"tactic":241},{"name":44},{"id":147,"name":148,"tactic":243},{"name":39},{"id":151,"name":152,"tactic":245},{"name":39},{"id":155,"name":156,"tactic":247},{"name":39},{"id":159,"name":160,"tactic":249},{"name":39},{"id":163,"name":164,"tactic":251},{"name":39},{"id":167,"name":168,"tactic":253},{"name":39},{"id":171,"name":172,"tactic":255},{"name":39},{"id":175,"name":176,"tactic":257},{"name":39},{"id":179,"name":180,"tactic":259},{"name":39},{"id":261,"name":262,"techniques":263},"CAPEC-58","Restful Privilege Elevation",[],[],[],[],[],[],[],"2026-08-16T04:24:49.468Z","Received",{"cisa_kev":273,"cisa_ransomware":273,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":274,"severity_score":275,"severity_version":276,"severity_source":277,"severity_vector":278,"severity_status":271},false,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[280,285,289,293,297,301,305,309,313,317,321,325],{"url":281,"sources":282,"tags":284},"https://www.wordfence.com/threat-intel/vulnerabilities/id/01404fad-7b5a-485a-b557-c608fe25e6c9?source=cve",[277,283],"nvd",[],{"url":286,"sources":287,"tags":288},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/actions/user.php#L680",[277,283],[],{"url":290,"sources":291,"tags":292},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/actions/user.php#L565",[277,283],[],{"url":294,"sources":295,"tags":296},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/classes/display.php#L1654",[277,283],[],{"url":298,"sources":299,"tags":300},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/classes/display.php#L37",[277,283],[],{"url":302,"sources":303,"tags":304},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/classes/display.php#L1953",[277,283],[],{"url":306,"sources":307,"tags":308},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/actions/user.php#L680",[277,283],[],{"url":310,"sources":311,"tags":312},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/actions/user.php#L565",[277,283],[],{"url":314,"sources":315,"tags":316},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/classes/display.php#L1654",[277,283],[],{"url":318,"sources":319,"tags":320},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/classes/display.php#L37",[277,283],[],{"url":322,"sources":323,"tags":324},"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/classes/display.php#L1953",[277,283],[],{"url":326,"sources":327,"tags":328},"https://plugins.trac.wordpress.org/changeset?reponame=&old=3633030%40acf-frontend-form-element&new=3633030%40acf-frontend-form-element",[277,283],[],[],[],[332,336],{"source":277,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":333,"cvss_v4_0":9},{"baseScore":275,"baseSeverity":334,"vectorString":278,"impactScore":275,"exploitabilityScore":335},"CRITICAL",10,{"source":283,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":337,"cvss_v4_0":9},{"baseScore":275,"baseSeverity":334,"vectorString":278,"impactScore":275,"exploitabilityScore":335},[339],{"ecosystem":9,"name":340,"vendor":341,"product":342,"cpe_part":343,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":344},"Frontend Admin by DynamiApps","shabti","frontend admin by dynamiapps","a",[345],{"version":346,"is_range":347,"range_type":277,"version_start":9,"version_start_type":9,"version_end":348,"version_end_type":349,"fixed_in":9},"\u003C= 3.29.9",true,"3.29.9","including"]