Frontend Admin by DynamiApps

Frontend Admin through 3.29.12 lacks capability and ownership checks in pre_update_value(), while ActionPost::conditions_logic() skips its edit_post authorization gate when a submitted post ID is non-numeric, such as user_1. An unauthenticated form submission can therefore target an arbitrary user record, replace an Administrator's email address, and use WordPress password reset to take over the account.

Frontend Admin through 3.29.12 fails to constrain file paths passed to move_folders(). When a form is public through who_can_see='all', its rendered page exposes the required nonce, allowing an unauthenticated attacker to delete arbitrary server files. Deleting a critical file such as wp-config.php can create a path to site compromise or code execution.

Frontend Admin through 3.29.11 insufficiently sanitizes and escapes the tag shortcode attribute. A Contributor or higher can store script that executes whenever another user views the affected page.

Frontend Admin by DynamiApps before 3.29.11 omits a capability check from an AJAX action. Any authenticated user, including a Subscriber, can invoke it and delete an arbitrary membership plan.

Frontend Admin by DynamiApps is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.29.10.

Frontend Admin by DynamiApps through 3.29.9 lets a crafted non-numeric item_id such as 1one bypass ActionUser::conditions_logic() because its edit_user authorization check only runs for numeric values. On a site exposing a public frontend user form, an unauthenticated attacker can obtain a signed _acf_objects payload carrying that value; WordPress later coerces it to user ID 1, allowing the administrator's password or email to be overwritten. Without a public user form, a Subscriber account is required. Other request fields and the complete payload construction are not disclosed.

Frontend Admin through 3.29.9 lets a Subscriber obtain a legitimate encrypted Current-User source token from an Edit User form they may submit. Because the AES-256-CBC ciphertext is not authenticated, the attacker can bit-flip the token so Submit_Form::check_inline_field() decrypts the posted acff source as another user_. The handler then calls acf_update_value() without reauthorizing the resolved user, and the user_password field's pre_update_value() calls wp_update_user() with the target ID and supplied password. This permits takeover of any account, including an Administrator. The cited.

Frontend Admin by DynamiApps through 3.29.10 allows an unauthenticated attacker to escalate privileges.

Frontend Admin by DynamiApps through 3.29.10 permits an authenticated Subscriber or higher to invoke an operation without the required authorization.

Frontend Admin by DynamiApps is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 3.28.8.

Frontend Admin by DynamiApps is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.29.2.

Frontend Admin by DynamiApps is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.29.2.

Frontend Admin by DynamiApps is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.28.36.

Frontend Admin by DynamiApps is affected by code execution. Exploitation requires an authenticated editor account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.28.31.

Frontend Admin by DynamiApps is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Frontend Admin by DynamiApps is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Frontend Admin by DynamiApps is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Frontend Admin by DynamiApps is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Frontend Admin by DynamiApps is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

Frontend Admin by DynamiApps is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.