Loading story…
A critical unauthenticated privilege-escalation flaw, CVE-2026-75816 (CVSS 9.8), affects the Frontend Admin by DynamiApps WordPress plugin, distributed under the acf-frontend-form-element slug. The vulnerability affects versions through 3.29.12 and stems from missing capability checks and an authorization bypass when non-numeric user or post identifiers are supplied.
An unauthenticated attacker can alter arbitrary users’ email addresses, then invoke WordPress’s password-reset process to seize an administrator account and fully compromise the affected site. DynamiApps remediated the issue in version 3.29.13; administrators should update immediately and review user email changes and password-reset activity. No active exploitation was reported at publication.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Frontend Admin version 3.29.13 introduced improved permission checks to address CVE-2026-75816. The source reported no known active exploitation at the time of publication.
CVE-2026-75816 was identified in Frontend Admin by DynamiApps versions through 3.29.12. The missing capability checks and authorization bypass can let an unauthenticated attacker alter an administrator's email address and use the WordPress password-reset flow to take over the account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical privilege-escalation flaw, tracked as **CVE-2025-14533**, was disclosed in the WordPress plugin **Advanced Custom Fields: Extended**, enabling an unauthenticated attacker to register or modify a user account with the **administrator** role under certain configurations. The bug was traced to improper role restrictions in the plugin’s user creation and editing form handling, specifically the `insert_user` function, which could allow full compromise of a vulnerable WordPress instance. The issue affects **version `0.9.2.1` and earlier**, and reporting indicated that roughly **100,000 WordPress sites** were affected. Exploitation requires exposed **Create User** or **Update User** forms that make the role field available, increasing risk for sites using those features insecurely. The plugin maintainers released **version `0.9.2.2` and later** to fix the vulnerability, and defenders were urged to update immediately and review sites for unauthorized administrator accounts.
Jul 24, 2026
A critical vulnerability, **CVE-2025-14533**, was disclosed in the WordPress plugin *Advanced Custom Fields: Extended* affecting versions **<= 0.9.2.1**. The issue is an **unauthenticated privilege escalation** in the plugin’s user-form handling, where the `insert_user` logic does not properly restrict which roles can be assigned during registration; as a result, an attacker can submit a registration request specifying the **`administrator`** role and obtain full administrative access under certain configurations. Reporting indicates exploitation depends on site configuration: the flaw is reachable when a form is set up such that the **`role`** value is mapped to a custom field / user role field is present in the form. The weakness was identified by **Andrea Bocchetti** via the **Wordfence Bug Bounty Program**, and is associated with **CWE-269 (Improper Privilege Management)**; once admin access is obtained, attackers can fully compromise the site (e.g., upload malicious plugins/themes, plant backdoors, or alter content for redirects).
Jun 29, 2026
A critical vulnerability in the **Kirki – Freeform Page Builder, Website Builder & Customizer** WordPress plugin is being actively exploited to take over administrator accounts on vulnerable sites. The flaw, tracked as **`CVE-2026-8206`** and rated **CVSS 9.8**, affects versions **6.0.0 through 6.0.6** and stems from a password-reset REST API that accepts an attacker-supplied email address even when the target account is identified by username. By submitting a privileged username and an email address they control, an unauthenticated attacker can obtain a valid password reset link, reset the victim’s password, and seize the account. Researchers estimate roughly **150,000** sites may be exposed among more than **500,000** active installations, and Wordfence reported blocking **59** attack attempts in a 24-hour period.
Jun 29, 2026