CVE-2026-75816 Details

A vulnerability in the Frontend Admin by DynamiApps plugin for WordPress, present in all versions up to and including 3.29.12, allows for authentication bypass leading to account takeover. The issue arises because the 'pre_update_value' function does not implement any capability or ownership checks. Additionally, the 'ActionPost::conditions_logic()' method bypasses the 'current_user_can('edit_post')' authorization requirement when the post ID is non-numeric, such as 'user_1'. This flaw enables unauthenticated form submissions to be directed to any user record without restrictions, allowing attackers to overwrite registered email addresses, including those of administrators, and subsequently use WordPress's password-reset feature to gain full access to the compromised account.