CVE-2025-14741: Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'deleteobject' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14741?
CVE-2025-14741 has been assessed as a medium severity vulnerability due to its potential for unauthorized data modification and deletion.
How do I fix CVE-2025-14741?
To fix CVE-2025-14741, update the DynamiApps Frontend Admin plugin to version 3.28.26 or later, which includes the necessary authorization checks.
What versions of DynamiApps Frontend Admin are affected by CVE-2025-14741?
CVE-2025-14741 affects all versions of the DynamiApps Frontend Admin plugin up to and including version 3.28.25.
What type of vulnerability is CVE-2025-14741?
CVE-2025-14741 is a vulnerability related to improper authorization that allows unauthorized data modification and deletion.
Can CVE-2025-14741 be exploited by unauthenticated users?
Yes, CVE-2025-14741 can be exploited by unauthenticated users due to the lack of capability checks in the delete_object function.