Shabti Kaplan
Monthly
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.
Privilege escalation in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) lets remote unauthenticated attackers elevate their privileges, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector rated 9.8 Critical. The flaw (CWE-266, Incorrect Privilege Assignment) stems from the plugin's frontend user-management forms exposing role/capability assignment without proper authorization, enabling an attacker to gain administrator-level access to the WordPress site. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but the CVSS profile indicates trivially weaponizable network-based abuse.
Broken access control in Frontend Admin by DynamiApps (WordPress plugin, versions ≤ 3.29.10) allows subscriber-level authenticated users to perform unauthorized privileged operations, resulting in high availability impact and limited integrity compromise on affected WordPress installations. The flaw stems from missing authorization checks (CWE-862), permitting low-privilege users to invoke restricted plugin functionality without proper capability verification. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.