CVE-2025-14736

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.

• CWE-269

• https://plugins.trac.wordpress.org/changeset/3427243/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472098%40acf-frontend-form-element&new=3472098%40acf-frontend-form-element&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07eb71fc-6588-490d-8947-3077ec4a9045?source=cve

Published

Jan 9, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14730A security flaw has been discovered in CTCMS Content Managem…7.2
• CVE-2025-14731A weakness has been identified in CTCMS Content Management S…7.2
• CVE-2025-14732The Elementor Website Builder – More Than Just a Page Builde…6.4
• CVE-2025-14733An Out-of-bounds Write vulnerability in the WatchGuard Firew…9.8
• CVE-2025-14734The Amazon affiliate lite Plugin plugin for WordPress is vul…5.4
• CVE-2025-14735The "Amazon affiliate lite Plugin" plugin for WordPress is v…4.4
• CVE-2025-14737Command Injection vulnerability in TP-Link WA850RE (httpd mo…8
• CVE-2025-14738Improper authentication vulnerability in TP-Link WA850RE (ht…7.5
• CVE-2025-14739Access of Uninitialized Pointer vulnerability in TP-Link WR9…6.8
• CVE-2025-1474In mlflow/mlflow version 2.18, an admin is able to create a …5.5
• CVE-2025-14740Docker Desktop for Windows contains multiple incorrect permi…6.7
• CVE-2025-14741The Frontend Admin by DynamiApps plugin for WordPress is vul…9.1