CVE-2026-116624

The Advanced Members for ACF WordPress plugin (versions

CVE-2026-116624 Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acfamemlocaluserpassword parameter of the advanced-members-account-password shortcode form submission. This is due to a PHP operator-precedence bug in the...

CVE-2026-75816

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-75816 CVE-2026-75816 Frontend Admin by DynamiApps 3.29.11 - shabti I am @abraxasnull. Loopback lab. The client is CVE-2026-75816-Abraxas-Labs.py. user1 is not a post. Unauthenticated admin-ajax.php...

VulnCheck KEV: CVE-2025-14736

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validatevalue', 'preupdatevalue', and 'getfieldsdisplay' functions. This makes it...

Exploit for CVE-2026-75816

abraxaslabs.tech · github.com/abraxas ·&...

Frontend Admin: Auth Bypass

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816

The Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.12 ) is vulnerable to unauthenticated account takeover via an authentication bypass. The root cause lies in the pre_update_value function lacking a capability or ownership check, combined with ActionPost::con...

CVE-2026-75816: Improper Authentication

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2025-14736: Improper Privilege Management

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validatevalue', 'preupdatevalue', and 'getfieldsdisplay' functions. This makes it...