CVE-2026-81346: Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit the affected AJAX action, including users with only the Subscriber role. The issue does not require administrative privileges.

Q: What can an attacker do?

An attacker can delete arbitrary membership plans through the vulnerable AJAX action. The provided information does not indicate any limitation to plans associated with the attacker’s own account.

Q: Which plugin versions are affected?

Frontend Admin by DynamiApps versions before 3.29.11 are affected. Version 3.29.11 is not described as affected by this issue.

Published Aug 29, 2026

Updated

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.

Affected Software

1 affected component

DynamiApps Frontend Admin<3.29.11

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit the affected AJAX action, including users with only the Subscriber role. The issue does not require administrative privileges.

What can an attacker do?

An attacker can delete arbitrary membership plans through the vulnerable AJAX action. The provided information does not indicate any limitation to plans associated with the attacker’s own account.

Which plugin versions are affected?

Frontend Admin by DynamiApps versions before 3.29.11 are affected. Version 3.29.11 is not described as affected by this issue.