CVE-2026-75816

Frontend Admin by DynamiApps 3.29.11 — shabti

Плагин Frontend Admin by DynamiApps для WordPress уязвим к обходу аутентификации с захватом учётной записи во всех версиях вплоть до 3.29.12 включительно. Это обусловлено тем, что функция pre_update_value не выполняет никаких проверок прав или принадлежности, а ActionPost::conditions_logic() обходит свою проверку авторизации current_user_can('edit_post') всякий раз, когда ID записи не является числом — например, строка user_1 — что позволяет направлять неаутентифицированные отправки форм к произвольным записям пользователей без ограничений. Это даёт неаутентифицированным злоумышленникам возможность перезаписать зарегистрированный адрес электронной почты любого пользователя, включая администратора, а затем воспользоваться встроенным в WordPress механизмом сброса пароля для полного захвата целевой учётной записи.

# CVE-2026-75816 (structured records) - input: `https://nvd.nist.gov/vuln/detail/CVE-2026-75816` - CWE: CWE-287 - published: 2026-09-06T03:17:16.607 ## NVD description The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account. ## MITRE description The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account. ## Affected - shabti Frontend Admin by DynamiApps 0 affected ## References (JSON sources only) - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/fields/user/class-user-email.php#L127 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/actions/post.php#L1001 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/actions/post.php#L1224 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/display.php#L26 - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.10/main/frontend/forms/classes/submit.php#L125 - https://plugins.trac.wordpress.org/changeset/3664865/acf-frontend-form-element - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1637a3b-7b0f-485d-9d19-4f711f8c671b?source=cve - https://github.com/advisories/GHSA-pv54-wq7v-wf7v - https://nvd.nist.gov/vuln/detail/CVE-2026-75816 ## GitHub advisory The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to... The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.

CVE	CVE-2026-75816 · CVE.org
CWE	CWE-287
CVSS	Critical: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
Продукт	Frontend Admin by DynamiApps
Затронуто	все версии вплоть до 3.29.11 (NVD указывает 3.29.12; в 3.29.12 добавлена проверка `edit_user` для поля Email)
Исправлено	3.29.12 и новее
Аутентификация	отсутствует (см. карту исходников)
Лицензия	GNU Affero GPL v3.0
Лаборатория	только `127.0.0.1` · пакет раскрытия для вендора/клиента, не сканер

CVE-2026-75816

Популярное

Рекомендация (из карты исходников)

Точка входа

Цепочка вызовов

Предусловия лаборатории

Свидетель

Не является успехом

Патч / устранение

Воспроизведение (авторизованная лаборатория)

Образы лаборатории

Ссылки

Записи (структурированные)

Лицензия

Отказ от ответственности