https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:53:03 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75816 <p>The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can(&#39;edit_post&#39;) authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user&#39;s registered email address, including an administrator&#39;s, and then leverage WordPress&#39;s native password-reset flow to fully take over the targeted account.</p> <p>The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can(&#39;edit_post&#39;) authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user&#39;s registered email address, including an administrator&#39;s, and then leverage WordPress&#39;s native password-reset flow to fully take over the targeted account.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75816 https://vulnerability.circl.lu/vuln/ghsa-pv54-wq7v-wf7v <p>The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can(&#39;edit_post&#39;) authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user&#39;s registered email address, including an administrator&#39;s, and then leverage WordPress&#39;s native password-reset flow to fully take over the targeted account.</p> <p>The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can(&#39;edit_post&#39;) authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user&#39;s registered email address, including an administrator&#39;s, and then leverage WordPress&#39;s native password-reset flow to fully take over the targeted account.</p> https://vulnerability.circl.lu/vuln/ghsa-pv54-wq7v-wf7v