PT-2026-1753 · Dynamiapps+1 · Frontend Admin+1

Andrea Bocchetti · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14741

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions through 3.28.25

Description The Frontend Admin by DynamiApps plugin for WordPress is affected by a missing authorization check, allowing unauthorized data modification and deletion. Specifically, a missing capability check on the delete object function enables unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.

Recommendations Versions prior to and including 3.28.25 should be updated to a newer, fixed version.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14741

Affected Products

Frontend Admin

Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14741 · Security Note
• https://twitter.com/CVEnew/status/2009532264959627296 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/53adbab6-953a-4a6f-bbfc-89efdbdd28e0?source=cve · Note
• https://t.me/CVEtracker/41800 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009559529009140029 · Twitter Post
• https://twitter.com/0dayPublishing/status/2009530821871280274 · Twitter Post
• https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.26/main/frontend/fields/general/class-delete-object.php?marks=106,119,132,142#L106 · Note