Frontend Admin by DynamiApps vulnerabilities
14 known vulnerabilities in Frontend Admin by DynamiApps from Shabti. 14 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Frontend Admin by DynamiApps: Improper Authentication
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPo
- 7.5 High severity
Frontend Admin by DynamiApps: Improper Limitation of a Pathname to a Restricted Directory
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attac
- 9.8 Critical severity
Frontend Admin by DynamiApps: Improper Privilege Management
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` auth
- 8.8 High severity
Frontend Admin by DynamiApps: Missing Authorization
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo
- 8.8 High severity
Frontend Admin by DynamiApps: Improper Privilege Management
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead
- 8.8 High severity
Frontend Admin by DynamiApps: Missing Authorization
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo
- 8.8 High severity
Frontend Admin by DynamiApps: Improper Privilege Management
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilitie
- 7.2 High severity
Frontend Admin by DynamiApps: Deserialization of Untrusted Data
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()`
- 7.2 High severity
Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitizat
- 9.1 Critical severity
Frontend Admin by DynamiApps: Missing Authorization
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This ma
- 9.8 Critical severity
Frontend Admin by DynamiApps: Improper Privilege Management
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get
- 9.8 Critical severity
Frontend Admin by DynamiApps: Missing Authorization
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptio
- 8.1 High severity
Frontend Admin by DynamiApps: Improper Privilege Management
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes i
- 9.8 Critical severity
Frontend Admin by DynamiApps: Improper Check for Unusual or Exceptional Conditions
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate