CVE-2025-13342: falha crítica em shabti Frontend Admin by DynamiApps
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
85Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 2.3%
da publicação à arma6 dias
Publicada no NVD3 de dez.
1ª PoC+6d
VulnCheck3 de dez.
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
shabti · Frontend Admin by DynamiAppsPoCs públicas encontradas — 2
vulncheckvulncheck.com/xdb/7a1de2885b2anão verificadovulncheckvulncheck.com/xdb/46e830760d0anão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — shabti Frontend Admin by DynamiApps
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19952HIGHFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge TagEPSS 1.2%CVE-2026-75816CRITICALFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object IdentifierEPSS 0.9%CVE-2026-18432CRITICALFrontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' ParameterEPSS 0.8%CVE-2024-3729CRITICALFrontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form ManipulationEPSS 0.8%CVE-2026-6226HIGHFrontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration InjectionEPSS 0.7%CVE-2025-14736CRITICALFrontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form FieldEPSS 0.7%