5.9
Medium
CVE-2026-81347 The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable…
Description
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Frontend Admin by DynamiApps 3.29 | earliest → < 3.29.13 | 3.29.13 |
Other CVEs of Frontend Admin by DynamiApps
The 4 CVEs of Frontend Admin by DynamiApps →
CVE-2026-81346
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its…
4.3
Medium
CVE-2026-13609
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value…
8.8
High
CVE-2026-11867
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy…
6.5
Medium