WordPress Plugin Vulnerabilities

Frontend Admin by DynamiApps < 3.29.11 - Missing Authorization

Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.29.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
acf-frontend-form-element
Fixed in 3.29.11

References

CVE
CVE-2026-66470
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/66b5662a-0be7-43f5-b055-02b3cd3a44d1

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
okndjo
Verified
No
WPVDB ID
3e0f7f33-1d51-4675-bdcd-f2a2c5bd53cd

Timeline

Publicly Published
2026-08-05 (about 1 month ago)
Added
2026-08-13 (about 1 month ago)
Last Updated
2026-08-29 (about 23 days ago)

Other

Published
Title
Published
2025-04-15
Title
JetPopup < 2.0.12 - Missing Authorization
Published
2025-05-09
Title
Uncanny Automator < 6.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Published
2024-05-10
Title
Flo Forms < 1.0.43 - Missing Authorization
Published
2026-06-05
Title
RSS Aggregator by Feedzy < 5.1.8 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions
Published
2025-05-16
Title
BERTHA AI <= 1.12.11 - Missing Authorization