CVE-2026-81346 DynamiApps CVE debrief

Who should care

WordPress site administrators using the Frontend Admin by DynamiApps plugin, especially those with subscriber or low-privilege user accounts, should review and restrict authenticated user permissions to prevent unauthorized actions. They should also verify plugin versions and monitor for suspicious membership plan deletions.

Technical summary

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 is vulnerable to unauthorized membership plan deletion due to a missing capability check in one of its AJAX actions. This allows any authenticated user, including subscribers, to delete arbitrary membership plans, potentially impacting site integrity. Defenders should verify plugin versions, restrict user permissions, and monitor for suspicious activity.

Defensive priority

Authenticated users with low privileges can delete membership plans, potentially impacting site integrity.

Recommended defensive actions

• Inventory and verify installed plugin versions.
• Restrict authenticated user permissions.
• Monitor for suspicious membership plan deletions.
• Apply vendor patch or update to version 3.29.11 or later.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans. Evidence from Wpscan indicates a capability check issue. Defenders should verify plugin versions and user permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.