HIGH🇵🇱 Wersja polska

CVE-2024-11721

CVSS 8.1v3.1pub. 2024-12-14upd. 2025-06-05

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new administrative user accounts, even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dynamiapps Frontend Admin

    APP
    Dynamiapps
    < 3.25.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth BypassLPE
CWE
References

Related vulnerabilities

CVE-2024-3729CRITICAL9.8PL ✓ten sam produkt

Auth Bypass i privilege escalation w pluginie Frontend Admin dla WordPress

CVE-2023-51411CRITICAL10.0PL ✓ten sam produkt

Nieuwierzytelniony upload dowolnych plików w WordPress Frontend Admin by DynamiApps

CVE-2025-26987HIGH7.1ten sam produkt

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shabti K...

CVE-2024-11720HIGH7.2ten sam produkt

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submiss...

CVE-2024-11722MEDIUM5.9ten sam produkt

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' paramet...