CVE-2026-19952: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in shabti Frontend Admin by DynamiApps

CVE-2026-19952 is a path traversal vulnerability in the Frontend Admin by DynamiApps WordPress plugin. The issue arises from insufficient validation of file paths in the move_folders function, enabling unauthenticated attackers to delete arbitrary files on the server. This is exploitable when a form is publicly visible (who_can_see='all'), allowing attackers to obtain the necessary nonce from the rendered form. Deletion of critical files like wp-config.php can facilitate remote code execution. The vulnerability affects all versions up to and including 3.29.12. No official patch or remediation guidance has been provided yet.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable plugin. This can lead to denial of service or remote code execution if critical files such as wp-config.php are deleted. The vulnerability compromises confidentiality and availability, with a CVSS score of 7.5 indicating high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid configuring forms with public visibility (who_can_see='all') to prevent unauthenticated exploitation. Monitor vendor communications for updates on patches or official mitigations.