CVE-2026-7802: Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter

Synopsis

Missing authorization in the Frontend Admin by DynamiApps plugin for WordPress (versions up to and including 3.29.2) allows any authenticated attacker with a subscriber-level account to take over administrator accounts. The vulnerability is reachable over the network and requires no elevated privileges, only a valid low-privilege login. A successful exploit gives the attacker full control of the targeted admin account by overwriting its password or email address, granting complete access to the WordPress site. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress application over the network; the plugin endpoint is exposed via standard HTTP/HTTPS requests.

• AuthenticationRequired

  A valid WordPress account is required, but any low-privilege role (subscriber or above) is sufficient; no elevated or admin credentials are needed.

• Victim interactionNot required

  The attacker submits a crafted request directly; no action from an administrator or any other user is needed to trigger the authorization bypass.

• Attack complexityDetail

  The exploit is reliable and condition-free once the targeted Edit-User form has its Roles setting left empty, which is noted in the description as the default-risk configuration; no race conditions or special memory layout are involved.

Blast Radius

• Attacker overwrites the target administrator's password directly, gaining immediate login access to the WordPress admin dashboard.
• Attacker replaces the administrator's email address and triggers a password-reset flow, redirecting the reset link to an attacker-controlled address.
• With admin-level access, the attacker reads all stored site content, user records, and any credentials or tokens held in the WordPress database.
• With admin-level access, the attacker installs or modifies plugins and themes, enabling arbitrary code execution on the underlying server.