PT-2026-1753 · Dynamiapps+1 · Frontend Admin+1

Andrea Bocchetti · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2025-14741

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions through 3.28.25

Description The Frontend Admin by DynamiApps plugin for WordPress is affected by a missing authorization check, allowing unauthorized data modification and deletion. Specifically, a missing capability check on the delete object function enables unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.

Recommendations Versions prior to and including 3.28.25 should be updated to a newer, fixed version.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14741

Produtos afetados

Frontend Admin

Wordpress

Referências · 7

• https://twitter.com/CVEnew/status/2009532264959627296 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/53adbab6-953a-4a6f-bbfc-89efdbdd28e0?source=cve · Nota
• https://t.me/CVEtracker/41800 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2009559529009140029 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2009530821871280274 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.26/main/frontend/fields/general/class-delete-object.php?marks=106,119,132,142#L106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14741 · Nota de Segurança