CVE-2026-75816: CWE-287 Improper Authentication in shabti Frontend Admin by DynamiApps
Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
CVSS v3.1
Score 9.8critical
Affected software
shabti
Frontend Admin by DynamiApps
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75816 describes an authentication bypass vulnerability in the Frontend Admin by DynamiApps WordPress plugin (versions up to 3.29.12). The vulnerability arises because the pre_update_value function does not perform capability or ownership checks, and the authorization gate in ActionPost::conditions_logic() is bypassed when the post ID is non-numeric (e.g., 'user_1'). This allows unauthenticated form submissions to modify arbitrary user records without restriction, including changing registered email addresses. Consequently, attackers can exploit WordPress's native password reset process to fully compromise user accounts.
Potential Impact
Successful exploitation allows unauthenticated attackers to overwrite any user's email address in the WordPress system, including administrators. This leads to full account takeover via the password reset mechanism, compromising confidentiality, integrity, and availability of affected accounts and potentially the entire WordPress site.
Mitigation Recommendations
No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for suspicious activity related to user email changes and password resets.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-18T10:01:34.135Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9cd57cacd9273b491a665c
Added to database: 09/06/2026, 02:52:44 UTC
Last enriched: 09/07/2026, 09:22:25 UTC
Last updated: 10/20/2026, 06:48:19 UTC
Views: 147
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.