Skip to main content

Frontend Admin CVE-2026-66470

| EUVDEUVD-2026-53887 HIGH
Missing Authorization (CWE-862)
2026-08-06 Patchstack GHSA-882f-272x-h54f
Authentication Bypass Frontend Admin By Dynamiapps
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
vuln.today AI
7.1 HIGH

Network-accessible WordPress plugin requiring only subscriber authentication (PR:L); high availability impact from unauthorized privileged actions; no confidentiality or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 06, 2026 - 15:43 vuln.today
CVE Published
Aug 06, 2026 - 14:27 cve.org
HIGH 7.1

DescriptionCVE.org

Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

AnalysisAI

Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain subscriber-level WordPress account
Delivery
Send crafted request to unprotected plugin endpoint
Exploit
Bypass missing authorization check
Execution
Execute privileged plugin action
Impact
Cause high-availability disruption to site content or functionality
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid WordPress subscriber-level account on the target site (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) reflects a moderate-to-high real-world risk profile with an important limiting factor: PR:L confirms exploitation requires an authenticated subscriber account, not unauthenticated access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a free subscriber account on a WordPress site running Frontend Admin by DynamiApps ≤ 3.29.10, or uses a pre-existing low-privilege credential. They then craft an HTTP POST request targeting a plugin endpoint - such as an AJAX action or REST route - that lacks proper capability checks, invoking a privileged operation (e.g., deleting form configurations or disrupting content structures) that causes significant availability degradation. …
Remediation Update the Frontend Admin by DynamiApps plugin to a version beyond 3.29.10 - the exact patched release version is not confirmed in the available data, so administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-29-10-broken-access-control-vulnerability for the verified fix version before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all WordPress installations to identify those running Frontend Admin version 3.29.10 or earlier and document subscriber and contributor user counts on affected sites. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Frontend Admin By Dynamiapps

View all
CVE-2026-13609 HIGH POC
8.8 Jul 31

Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows una
CVE-2026-11867 MEDIUM POC
6.5 Jul 30

Missing authorization in Frontend Admin by DynamiApps WordPress plugin (versions before 3.29.7) exposes taxonomy term cr
CVE-2026-18432 CRITICAL
9.8 Aug 16

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers t
CVE-2026-66662 CRITICAL
9.8 Aug 06

Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets re
CVE-2026-15606 HIGH
8.8 Aug 11

Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) a
CVE-2026-66638 MEDIUM
6.5 Aug 18

Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10)

CVE-2026-10039 MEDIUM
4.9 May 29

SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated a

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-66470 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy