{"id":"CVE-2025-14736","aliases":["EUVD-2026-1804","GHSA-cp49-57ww-rmvr"],"status":"published","title":"Frontend Admin by DynamiApps \u003c= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field","description":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00721,"percentile":0.54227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-269"],"published":"2026-01-09T06:34:51Z","modified":"2026-06-17T08:36:28Z","exploits":[{"source":"pocgithub","id":"hyunchiya/CVE-2025-14736","title":"hyunchiya/CVE-2025-14736","date":"2026-01-09","url":"https://github.com/hyunchiya/CVE-2025-14736"}],"products":[{"vendor":"shabti","product":"frontend admin by dynamiapps"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07eb71fc-6588-490d-8947-3077ec4a9045?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3427243/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3472098%40acf-frontend-form-element\u0026new=3472098%40acf-frontend-form-element\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14736"},{"url":"https://github.com/advisories/GHSA-cp49-57ww-rmvr"}],"sources":{"cve":[{"id":"CVE-2025-14736","title":"Frontend Admin by DynamiApps \u003c= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field","description":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.","status":"published","published":"2026-01-09T06:34:51.712Z","modified":"2026-04-08T16:34:05.628Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2026-1804","description":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.","status":"published","published":"2026-01-09T06:34:51Z","modified":"2026-04-08T16:34:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:10.76969Z"}],"ghsa":[{"id":"GHSA-cp49-57ww-rmvr","title":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in...","description":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.25. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.","status":"published","published":"2026-01-09T09:31:18Z","modified":"2026-04-08T18:35:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:07:18.583007Z"}],"nvd":[{"id":"CVE-2025-14736","description":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.","status":"published","published":"2026-01-09T07:16:01.333Z","modified":"2026-06-17T08:36:28.673Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:11:56.616231Z"}]}}