Cyber & AI intelligence
Wasteland.
Briefs indexed2452
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-75816 2026-09-06

CVE-2026-75816: Unauthenticated Account Takeover in WordPress Frontend Admin by DynamiApps

"A broken authorization check in the Frontend Admin by DynamiApps plugin lets unauthenticated attackers rewrite any user's email address, including an administrator's, and seize the account through WordPress's own…"

A broken authorization check in the Frontend Admin by DynamiApps plugin lets unauthenticated attackers rewrite any user's email address, including an administrator's, and seize the account through WordPress's own password-reset flow.

What Is It

CVE-2026-75816 is a CVSS 9.8 (CRITICAL) authentication bypass leading to account takeover, tracked as CWE-287 (Improper Authentication). The flaw has two halves. First, the plugin's pre_update_value function performs no capability or ownership check at all. Second, ActionPost::conditions_logic() short-circuits its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric; for example, the string user_1. Together, these allow unauthenticated form submissions to be routed to arbitrary user records without restriction.

The attack vector is network-based, requires low complexity, no privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Why It Matters

An attacker who can reach a public-facing form rendered by this plugin can overwrite the registered email address of any account on the site, including an administrator's. From there, the native WordPress password-reset flow delivers the reset link to the attacker-controlled address, completing full takeover of the targeted account. No credentials, no social engineering, and no existing foothold are needed; which is why confidentiality, integrity, and availability impacts are all rated HIGH.

This CVE does not currently appear in the CISA Known Exploited Vulnerabilities catalog; no supplied source confirms active exploitation in the wild.

What's Vulnerable

Patch Status

The issue was addressed upstream in changeset 3664865. Administrators running 3.29.12 or earlier should update to a fixed release immediately; given that exploitation requires no authentication, any exposed installation should be treated as reachable. The CVE record was published 2026-09-06 by Wordfence and remains in "Received" status pending NVD enrichment.

Sources