What is the CVSS score of CVE-2026-66470?

CVE-2026-66470 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Frontend Admin are affected by CVE-2026-66470?

The Frontend Admin WordPress plugin (versions ≤ 3.29.10) contains a broken access control vulnerability allowing authenticated subscribers and contributors to perform unauthorized administrative…

How to fix or mitigate CVE-2026-66470?

Within 24 hours, inventory all WordPress installations to identify those running Frontend Admin version 3.29.10 or earlier and document subscriber and contributor user counts on affected sites. Within 7 days, restrict subscriber and contributor role capabilities to essential functions through WordPress role management, consider disabling the Frontend Admin plugin if business operations permit, and implement detailed access logging for administrative actions. Within 30 days, monitor DynamiApps' security advisory channels for a patch release and prepare for immediate deployment; if no patch is available by day 30, evaluate alternative plugins and execute migration plan.

Frontend Admin CVE-2026-66470

EUVD-2026-53887 HIGH

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-882f-272x-h54f

WordPress Authentication Bypass Frontend Admin By Dynamiapps Wordpress Plugin Shabti Kaplan

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Network-accessible WordPress plugin requiring only subscriber authentication (PR:L); high availability impact from unauthorized privileged actions; no confidentiality or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:43 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

AnalysisAI

Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Frontend Admin by DynamiApps (CPE: cpe:2.3:a:shabti_kaplan:frontend_admin_by_dynamiapps) is a WordPress plugin authored by Shabti Kaplan that enables site administrators to expose frontend-facing forms for editing WordPress posts, users, and custom content types. CWE-862 (Missing Authorization) identifies the root cause: the plugin fails to enforce capability or role checks before executing sensitive operations accessible through its frontend form endpoints. In WordPress's permission model, the 'subscriber' role is the lowest authenticated tier, typically granted to registered site users with no editorial or administrative access. When authorization gates are absent or insufficient, subscribers can reach code paths intended for editors, authors, or administrators - a common flaw in WordPress plugins that register AJAX actions or REST endpoints without nonce or capability validation.

RemediationAI

Update the Frontend Admin by DynamiApps plugin to a version beyond 3.29.10 - the exact patched release version is not confirmed in the available data, so administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-29-10-broken-access-control-vulnerability for the verified fix version before upgrading. As an immediate compensating control, sites with open user registration should temporarily disable new subscriber account creation under Settings > General > Membership in WordPress, reducing the attacker's ability to obtain a qualifying account. Alternatively, if the plugin's frontend forms are not required for subscriber-role users, administrators can restrict plugin-registered endpoints at the web server or WAF layer by blocking requests to the relevant AJAX actions or REST routes identified in the plugin's source. Each workaround reduces attack surface without eliminating the underlying flaw; patching remains the authoritative remediation.