Loading vulnerability…
Frontend Admin by DynamiApps for WordPress through version 3.29.12 contains an arbitrary file deletion vulnerability in its move_folders function. Insufficient validation of attacker-controlled file paths permits deletion of arbitrary files accessible to the web-server process. The flaw can be invoked without authentication when a Frontend Admin form is configured for public visibility, because the required nonce is exposed in the rendered public form.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This seven-file disclosure/lab repository contains one Python exploit proof, a README advisory, AGPLv3 license, and Docker Compose assets for a loopback-only WordPress/MySQL environment. The Python program targets CVE-2026-19952 in the Frontend Admin by DynamiApps WordPress plugin through version 3.29.12. It retrieves a public form, extracts ACF state and nonce values, then posts to /wp-admin/admin-ajax.php with action frontend_admin/form_submit. A traversal value in a title field is consumed by the vulnerable upload_files move_folders path construction, allowing deletion of an index.php file in an attacker-selected relative directory. The proof uses a harmless local witness path, validates success only when POCWitness19952 disappears, and exits otherwise. Although repository text notes file deletion could potentially facilitate RCE in other circumstances, the supplied code performs no code execution or shell delivery. Docker assets pin WordPress 6.4/PHP 8.2 and MySQL 8.0, expose WordPress solely as 127.0.0.1:8088, and mount the affected plugin source read-only.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.