Paper/Archive/CVE-2025-14741

CVE-2025-14741

shabti Frontend Admin by DynamiApps — Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element

EPSS 0.4%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 32.4.324 × 206.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.

Affected

ProductAffectedFixed inSource

Frontend Admin by DynamiApps≤ 3.28.25–CNA

Scores by source

Wordfence (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refwordfence.com/threat-intel/vulnerabilities/id/53adbab6-953a-4a6f-bbfc-89efdbdd28e0?source=cve refplugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.28.26/main/frontend/fields/general/class-delete-object.php?marks=106,119,132,142#L106