Loading vulnerability…
CVE-2026-75816 is an authentication-bypass and authorization flaw in the Frontend Admin by DynamiApps plugin for WordPress through version 3.29.12. The plugin's pre_update_value function does not enforce capability or ownership validation before applying field updates. In addition, ActionPost::conditions_logic() bypasses its current_user_can('edit_post') authorization check when it receives a non-numeric identifier. An unauthenticated attacker can use a crafted non-numeric user identifier to direct a form submission to an arbitrary WordPress user record and replace that user's registered email address. The attacker can then use WordPress's native password-reset process to reset the target account's password.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This seven-file disclosure and local lab repository contains a Python proof of concept, documentation, AGPLv3 license, and Docker Compose configuration for reproducing CVE-2026-75816. The main executable, CVE-2026-75816-Abraxas-Labs.py, performs a GET request to a public Frontend Admin form, extracts required ACF form tokens and the encrypted object metadata, then sends an unauthenticated POST to WordPress admin-ajax.php using the frontend_admin/form_submit action. The vulnerable authorization flow permits a nonnumeric object ID such as user_1 to bypass the expected post-edit authorization check; the Email field update path then calls WordPress user-update functionality without an adequate user-capability/ownership check. The supplied PoC changes the lab administrator email to a fixed witness address and checks the lab probe endpoint to confirm success. It does not include a shell, persistence mechanism, callback infrastructure, credential theft, or an automated password-reset/account-takeover step. The lab Compose stack uses WordPress 6.4/PHP 8.2, MySQL 8.0, and exposes WordPress only on 127.0.0.1:8088. Repository claims indicate 3.29.11 is the vulnerable lab version and that 3.29.12 introduced the relevant Email-field permission check, despite an inconsistent statement elsewhere that references versions through 3.29.12.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical, unauthenticated account-takeover vulnerability in Frontend Admin by DynamiApps for WordPress. Missing capability checks and an authorization-validation bypass permit remote attackers to change arbitrary user email addresses, including administrator accounts, and reset their passwords.
An unauthenticated authentication-bypass/account-takeover vulnerability in the Frontend Admin by DynamiApps WordPress plugin. Attackers can submit crafted forms that target arbitrary user records, overwrite a user's email address—including an administrator's—and use WordPress password reset to take over the account.
An unauthenticated authentication-bypass/account-takeover vulnerability in the Frontend Admin by DynamiApps WordPress plugin through version 3.29.12. Missing capability and ownership validation in pre_update_value, combined with an authorization-gate bypass when a non-numeric post ID such as "user_1" is supplied, lets attackers overwrite arbitrary users' email addresses and use the native WordPress password-reset process to take over accounts, including administrator accounts.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.