CVE-2026-75816: Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic() short-circuiting its currentusercan('editpost') authorization gate whenever the post ID is non-numeric — such as the string user1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an existing WordPress account or administrator access?
No. The issue can be exploited through unauthenticated form submissions, with no credentials or prior privileges required.
Which user accounts can an attacker target?
An attacker can route submissions to arbitrary user records and overwrite the registered email address of any user, including administrators.
How can an email-address change lead to full account compromise?
After replacing the target's email address, the attacker can use WordPress's native password-reset flow to set a new password and take over the account.