These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover due to a lack of capability or ownership checks in the pre_update_value function and a short-circuit in ActionPost::conditions_logic(). This allows unauthenticated attackers to overwrite user email addresses and potentially take over accounts via WordPress's password-reset flow.
A SQL injection vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows authenticated administrators to extract sensitive database information. The flaw exists in the payment list administration page where the 'order' parameter is concatenated into SQL queries without adequate escaping or prepared statement usage. Exploitation requires both 'order' and 'orderby' parameters to reach the v [truncated]
A critical privilege escalation vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows unauthenticated attackers to create administrator accounts. The flaw stems from insecure form submission handling that accepts arbitrary form definitions from user input rather than securely loading validated configurations from the backend. When the `_acf_form` POST parameter is submitted as an array [truncated]
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. The plugin fails to properly verify that a user is authorized to perform actions on target accounts. Authenticated attackers with subscriber-level access and above can overwrite an administrator's user_pass, user_email, first_name, last_name, and other profile fields by [truncated]