PT-2026-1752 · Dynamiapps+1 · Frontend Admin+1

Andrea Bocchetti · Publicado 2026-01-09 · Atualizado 2026-01-23 · CVE-2025-14736

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions through 3.28.25

Description The Frontend Admin by DynamiApps plugin for WordPress has a flaw that allows unauthenticated attackers to register as administrators and gain complete control of a site. This is possible because user-supplied role values are not adequately validated in the validate value, pre update value, and get fields display functions. An attacker needs access to a user registration form that includes a Role field to exploit this issue.

Recommendations Versions prior to 3.28.25 should be updated.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-14736

Produtos afetados

Frontend Admin

Wordpress

Referências · 9

• https://wordfence.com/threat-intel/vulnerabilities/id/07eb71fc-6588-490d-8947-3077ec4a9045?source=cve · Nota
• https://t.me/cveNotify/148185 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2009515721701630282 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009526577466409470 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14736 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472098%40acf-frontend-form-element&new=3472098%40acf-frontend-form-element&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/changeset/3427243/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php · Nota
• https://twitter.com/TuringCyberObs/status/2014644120787001477 · Publicação no Twitter
• https://twitter.com/Nxploited/status/2009598581276352771 · Publicação no Twitter