DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update
DynamiApps Frontend Admin plugin for WordPress <.= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run() save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data.
PoC 已收录acf-frontend-form-element
CVSS9.8EPSS 2.2%