Vulnerability · Published Jul 30, 2026 · Assigned by WPScan
CVE-2026-11867Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization
Medium 6.5
In plain English
A medium-severity missing authorization in Frontend Admin by DynamiApps from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 77.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Frontend Admin by DynamiApps | 0 – before 3.29.7 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://wpscan.com/vulnerability/63c90b08-fcff-4bd0-8953-b5cc5c796dbe/ exploit, vdb-entry, technical-description