Frontend Admin <= 3.28.28 Authenticated SQL Injection in 'order' Parameter (CVE-2026-10039)

Vulnerability Overview Vulnerability Name: Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter CVE ID: CVE-2026-10039 CVSS Score: 4.9 (Medium) Publication Date: May 28, 2026 Last Updated: May 29, 2026 Researchers: Louis Deschanel (JeanJeanLeHaxor), Patrowl, Pascal SUN - Patrowl Affected Versions Software Type: Plugin Software Name: acf-frontend-form-element Affected Versions: <= 3.28.8 Fixed Version: 3.28.29 Remediation Recommendation: Update to version 3.28.29 or later patched versions Additional Information Description: The Frontend Admin by DynamiApps plugin for WordPress contains an SQL injection vulnerability, allowing attackers to inject malicious SQL code via the 'order' parameter. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter - CVE ID: CVE-2026-7802 - CVSS Score: 8.8 - Researcher: Tiago Ventura (persec) - Publication Date: May 27, 2026 Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection - CVE ID: CVE-2026-6226 - CVSS Score: 8.8 - Researcher: daroo - Publication Date: May 27, 2026 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form - CVE ID: CVE-2026-6228 - CVSS Score: 8.6 - Researcher: Colin Xu - Publication Date: May 14, 2026 Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form-Posts - CVE ID: CVE-2026-3328 - CVSS Score: 7.2 - Researcher: Osvaldo Nue Gonzalez Del Rio (Ds) - Publication Date: March 25, 2026 Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field' - CVE ID: CVE-2025-14937 - CVSS Score: 7.2 - Researcher: Paolo Tresso - Publication Date: January 8, 2026 Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element - CVE ID: CVE-2025-14741 - CVSS Score: 9.1 - Researcher: andrea bocchetti - Publication Date: January 8, 2026 Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field - CVE ID: CVE-2025-14736 - CVSS Score: 9.8 - Researcher: andrea bocchetti - Publication Date: January 8, 2026 Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update - CVE ID: CVE-2025-13342 - CVSS Score: 9.8 - Researcher: YC_Infosec - Publication Date: December 3, 2025 Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection - CVE ID: CVE-2025-49267 - CVSS Score: 6.5 - Researcher: Friss0n - Publication Date: August 12, 2025 Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion - CVE ID: CVE-2025-49303 - CVSS Score: 6.5 - Researcher: 0x4dr5id3 - Publication Date: June 26, 2025 Additional Resources Wordfence Intelligence: Provides free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Notifies users of the latest vulnerabilities and offers webhook integration. Wordfence Intelligence WordPress Vulnerability Database: Completely free access and querying, with API documentation available. Contact Technical Support: 9am-8pm ET, 5am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, 1-hour response time Copyright Information Copyright: 2012-2026 Defiant Inc. License: CVE usage license from MITRE Corporation Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Twitter: Link Facebook: Link LinkedIn: Link Instagram: Link Products and Support Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Support Documentation: Link Learning Center: Link Free Support: Link Premium Support: Link News Blog: Link In The News: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Employment: Link Contact: Link Security: Link CVE Request Form: Link Subscription Sign up for news and updates: Link Footer © 2012-2026 Defiant Inc. All Rights Reserved

Goal Reached Thanks to every supporter — we hit 100%!

Frontend Admin <= 3.28.28 Authenticated SQL Injection in 'order' Parameter (CVE-2026-10039)