Frontend Admin CVE-2026-11867

Exploitation requires a valid WordPress user account at Subscriber privilege level or above (PR:L per CVSS vector). The Frontend Admin by DynamiApps plugin must be installed, active, and running a version below 3.29.7. The target WordPress site must have user registration enabled, or the attacker must otherwise obtain a low-privilege account through another means (e.g., invitation, purchase, or separate account creation vulnerability). No special plugin configuration is required beyond default installation - the missing capability checks apply to the plugin's standard taxonomy operations out of the box. Exploitation is bounded to taxonomy integrity impact only: C:N and A:N per CVSS confirm no data disclosure or denial-of-service component. The SSVC automatable:no assessment reflects that the authentication prerequisite prevents fully unauthenticated mass scanning, limiting exploitation to actors who can obtain or already hold site credentials.

The CVSS 3.1 score of 6.5 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the attack profile: network-reachable, low complexity, authenticated low-privilege access, no user interaction, and high integrity impact scoped to the vulnerable system. Notably, EPSS at 0.14% (4th percentile) is strikingly low given that a public POC exists - this divergence suggests the POC has not been operationalized into mass scanning or automated exploitation tools at time of analysis. SSVC corroborates: exploitation status is POC (not active), automatable is NO (the authentication prerequisite prevents fully unauthenticated mass exploitation), and technical impact is rated partial. No CISA KEV listing confirms active in-the-wild abuse. Real-world priority is site-contextual: WordPress installations with open user registration are directly exposed, as any registered account becomes a potential attacker. Sites without user registration or with restricted account creation face significantly reduced risk. The absence of confidentiality and availability impact (C:N/A:N) limits blast radius to taxonomy integrity - disruptive but not data-exfiltrating.

A user who has registered a free Subscriber account on a WordPress site running Frontend Admin by DynamiApps before 3.29.7 crafts HTTP requests directly to the plugin's taxonomy management endpoint - leveraging the publicly available POC from WPScan - to rename or delete site-wide taxonomy terms such as product categories or post tags. Because no capability check is enforced, the operation succeeds immediately without any further privilege escalation. The attacker can systematically corrupt or remove taxonomy structures, breaking site navigation, search filtering, and content organization.