CVE-2026-15606 is an authorization bypass vulnerability in the Frontend Admin by DynamiApps WordPress plugin affecting all versions up to 3.29.9. The plugin fails to properly verify user authorization before allowing password reset actions. An attacker with subscriber-level or higher privileges can exploit this by using a valid encrypted Current-User token obtained from legitimately accessible Edit User forms as a known-plaintext base for a CBC bit-flipping forgery attack. This enables resetting passwords of any user, including administrators, resulting in full account takeover and complete site compromise. The CVSS 3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker with minimal privileges to reset passwords of any user on the site, including administrators. This leads to full account takeover and complete compromise of the WordPress site, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict user permissions to trusted users only and monitor for suspicious activity related to password resets. Avoid granting subscriber-level or higher permissions to untrusted users. Follow vendor advisories for updates.