CVE-2025-13342: fallo crítico en shabti Frontend Admin by DynamiApps
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
85Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 2.3%
de la publicación al arma6 días
Publicada en NVD3 dic
1ª PoC+6d
VulnCheck3 dic
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
shabti · Frontend Admin by DynamiAppsPoCs públicas encontradas — 2
vulncheckvulncheck.com/xdb/7a1de2885b2ano verificadovulncheckvulncheck.com/xdb/46e830760d0ano verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — shabti Frontend Admin by DynamiApps
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-19952HIGHFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge TagEPSS 1.2%CVE-2026-75816CRITICALFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object IdentifierEPSS 0.9%CVE-2026-18432CRITICALFrontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' ParameterEPSS 0.8%CVE-2024-3729CRITICALFrontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form ManipulationEPSS 0.8%CVE-2026-6226HIGHFrontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration InjectionEPSS 0.7%CVE-2025-14736CRITICALFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form FieldEPSS 0.7%