PT-2026-1752 · Dynamiapps+1 · Frontend Admin+1

Andrea Bocchetti · Published 2026-01-09 · Updated 2026-01-23 · CVE-2025-14736

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions through 3.28.25

Description The Frontend Admin by DynamiApps plugin for WordPress has a flaw that allows unauthenticated attackers to register as administrators and gain complete control of a site. This is possible because user-supplied role values are not adequately validated in the validate value, pre update value, and get fields display functions. An attacker needs access to a user registration form that includes a Role field to exploit this issue.

Recommendations Versions prior to 3.28.25 should be updated.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-14736

Affected Products

Frontend Admin

Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14736 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/07eb71fc-6588-490d-8947-3077ec4a9045?source=cve · Note
• https://t.me/cveNotify/148185 · Telegram Post
• https://twitter.com/0dayPublishing/status/2009515721701630282 · Twitter Post
• https://twitter.com/CVEnew/status/2009526577466409470 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472098%40acf-frontend-form-element&new=3472098%40acf-frontend-form-element&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset/3427243/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php · Note
• https://twitter.com/TuringCyberObs/status/2014644120787001477 · Twitter Post
• https://twitter.com/Nxploited/status/2009598581276352771 · Twitter Post