CVE-2025-14736: Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validatevalue', 'preupdatevalue', and 'getfieldsdisplay' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14736?
CVE-2025-14736 is classified as a Privilege Escalation vulnerability.
How do I fix CVE-2025-14736?
To fix CVE-2025-14736, update the DynamiApps Frontend Admin plugin to version 3.28.26 or later.
What versions of DynamiApps Frontend Admin are affected by CVE-2025-14736?
All versions of DynamiApps Frontend Admin up to and including 3.28.25 are affected by CVE-2025-14736.
What causes CVE-2025-14736?
CVE-2025-14736 is caused by insufficient validation of user-supplied role values in specific functions of the plugin.
Can CVE-2025-14736 allow unauthorized access?
Yes, CVE-2025-14736 can allow unauthorized users to escalate their privileges within the WordPress site.