Shabti
Monthly
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Unauthenticated privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows remote attackers to create administrator accounts by submitting a crafted form payload. The flaw stems from the plugin trusting an attacker-supplied form definition passed via $_POST['_acf_form'] as an array, which bypasses the legitimate server-side form lookup and allows the role field's allowed values to be spoofed. No public exploit identified at time of analysis, but the vulnerability is reported by Wordfence and is straightforwardly weaponizable given the documented logic flaw.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows authenticated subscriber-level users to overwrite arbitrary user profile fields - including administrator passwords and email addresses - by supplying a chosen user_id parameter to a vulnerable Edit-User form. This authorization-bypass flaw (CWE-862) enables full administrator account takeover through direct password replacement or email-redirect password reset, and no public exploit identified at time of analysis. The vulnerability requires a specific misconfiguration where the form's Roles setting is left empty, which limits exploitable installs but is a common default state.
Privilege escalation in Frontend Admin by DynamiApps plugin allows authenticated attackers with editor-level access to elevate privileges to administrator. The vulnerability exists due to insufficient authorization checks when configuring user role options in edit_user forms combined with overly permissive capabilities on the admin_form post type. Attackers can bypass UI restrictions by directly manipulating POST data to include 'administrator' in role_options, then use the crafted form to assign themselves administrator privileges. CVSS 8.8 reflects network-accessible, low-complexity exploitation requiring only low privileges (editor account). No public exploit code identified at time of analysis, though the attack chain is straightforward for authenticated users. EPSS data not provided, but the technical barrier is minimal once editor access is obtained.
The Frontend Admin by DynamiApps plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 3.28.31. Authenticated attackers with Editor-level privileges or higher can exploit unsafe deserialization of the 'post_content' field in admin_form posts to inject malicious PHP objects and achieve remote code execution through available POP chains. This represents a critical risk for WordPress sites using this plugin with elevated user accounts.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) lets attackers take over the default administrator account by overwriting its password or email. The flaw stems from an authorization check that is silently skipped when the target user ID is a non-numeric string, which WordPress later coerces to integer 1 (the default admin). Where a public-facing frontend user form is configured the attack is fully unauthenticated; otherwise any subscriber-level account suffices. No public exploit identified at time of analysis, but the CVSS is 9.8 (Critical) and it was reported by Wordfence.
Password reset authorization bypass in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.9) allows any authenticated subscriber to overwrite the credentials of any account on the site, including administrators, leading to full account takeover and complete site compromise. The plugin improperly validates authorization during password reset operations and protects user identity with a CBC-mode encrypted token; an attacker who legitimately obtains that token through an authorized Edit User form submission can apply standard CBC bit-flipping techniques to forge a token resolving to any other user identity, including site admins, without possessing the encryption key. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV, though the low technical barrier and well-documented nature of CBC bit-flipping make this high-urgency for affected deployments.
Unauthenticated privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows remote attackers to create administrator accounts by submitting a crafted form payload. The flaw stems from the plugin trusting an attacker-supplied form definition passed via $_POST['_acf_form'] as an array, which bypasses the legitimate server-side form lookup and allows the role field's allowed values to be spoofed. No public exploit identified at time of analysis, but the vulnerability is reported by Wordfence and is straightforwardly weaponizable given the documented logic flaw.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.2) allows authenticated subscriber-level users to overwrite arbitrary user profile fields - including administrator passwords and email addresses - by supplying a chosen user_id parameter to a vulnerable Edit-User form. This authorization-bypass flaw (CWE-862) enables full administrator account takeover through direct password replacement or email-redirect password reset, and no public exploit identified at time of analysis. The vulnerability requires a specific misconfiguration where the form's Roles setting is left empty, which limits exploitable installs but is a common default state.
Privilege escalation in Frontend Admin by DynamiApps plugin allows authenticated attackers with editor-level access to elevate privileges to administrator. The vulnerability exists due to insufficient authorization checks when configuring user role options in edit_user forms combined with overly permissive capabilities on the admin_form post type. Attackers can bypass UI restrictions by directly manipulating POST data to include 'administrator' in role_options, then use the crafted form to assign themselves administrator privileges. CVSS 8.8 reflects network-accessible, low-complexity exploitation requiring only low privileges (editor account). No public exploit code identified at time of analysis, though the attack chain is straightforward for authenticated users. EPSS data not provided, but the technical barrier is minimal once editor access is obtained.
The Frontend Admin by DynamiApps plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 3.28.31. Authenticated attackers with Editor-level privileges or higher can exploit unsafe deserialization of the 'post_content' field in admin_form posts to inject malicious PHP objects and achieve remote code execution through available POP chains. This represents a critical risk for WordPress sites using this plugin with elevated user accounts.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL Injection in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.28.28) allows authenticated administrators to extract arbitrary data from the WordPress database via the 'order' parameter in the payments list view. The vulnerability stems from unsanitized concatenation of user-supplied input into a raw SQL query, reachable only when a valid 'orderby' parameter is also present in the same request. No public exploit has been identified at time of analysis, and the high privilege requirement (administrator-level) substantially limits the realistic attacker pool, keeping this a medium-severity, low-urgency finding despite the AV:N classification.