VulnSocial

CVE-2026-75816Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 4 mentions (2026-09-06); latest day: 1
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-09-06: 4Mentions · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-06: 2PoC Mentioned / Linked · 2026-09-19: 1Exploit Tool / Code · 2026-09-19: 1Patch / Workaround · 2026-09-06: 1Technical Details · 2026-09-06: 3Technical Details · 2026-09-19: 109-0609-19
Signal classification4 categories
Disclosure
240.0%
General
120.0%
PoC
120.0%
Exploit
120.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-064
Disclosure2General1PoC1
2026-09-191
Exploit1
Full discourse5 posts
  • abraxas@abraxas_null
    Exploit

    CVE-2026-75816 - Wordpress - Frontend Admin - Critical 9.8 - Unauthenticated POST /wp-admin/admin-ajax.php - Account Takeover jealousy is the #1 killer of all mankind exploit: https://github.com/abraxas/CVE-2026-75816 writeup (with infra): https://abraxaslabs.tech/research/cve-2026-75816

    Post summary

    The post shares a functional exploit for CVE-2026-75816 in WordPress, enabling account takeover via admin-ajax.php, with links to a GitHub repo and detailed writeup. No active exploitation or patch details were mentioned.

    10040171
    636 followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-86152 CVE-2026-86218 CVE-2026-10196 CVE-2026-16310 CVE-2026-75816 ..🧵👇

    Post summary

    The Digest lists several CVEs but provides no further technical or operational details.

    1001069
    40 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 WordPress'te kritik hesap ele geçirme açığı: CVE-2026-75816 Frontend Admin by DynamiApps eklentisinde, kimlik doğrulaması gerektirmeyen Account Takeover açığı keşfedildi. 3.29.12 ve öncesi sürümler etkileniyor. Saldırgan, yetkilendirme kontrollerini aşarak herhangi bir kullanıcının — administrator dahil — e-posta adresini değiştirebiliyor ve ardından WordPress'in parola sıfırlama mekanizmasını kullanarak hesabı ele geçirebiliyor. 🚨 CVSS: 9.8 Critical Etkilenen sürümler kullanılıyorsa 3.29.13 veya üzeri sürüme güncelleme yapılması gerekiyor.

    Post summary

    CVE-2026-75816 is a newly disclosed critical account takeover vulnerability in WordPress Frontend Admin (versions <3.29.12), with CVSS 9.8; users are advised to upgrade to 3.29.13 or later.

    00001292
    2.3K followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🔐🚨 Frontend Admin WordPress Plugin — CVSS 9.8 CRITICAL CVE-2026-75816: Unauthenticated admin takeover → Change any user email (including admin) → https://threataft.com/articles/frontend-admin-dynamiapps-cve-2026-75816 #cybersecurity #infosec #WordPress #PluginSecurity #AdminTakeover #CVSS9 #PatchNow #ThreatIntel

    Post summary

    CVE‑2026‑75816 is a high‑severity (CVSS 9.8) vulnerability in a WordPress plugin that lets unauthenticated attackers change any user’s email to take over admin privileges; a PoC is referenced via an external article.

    0001058
    42 followersView on X
  • ExploitGrid@exploitgrid
    PoC

    [CVE] CVE-2026-75816 [HIGH PRIORITY] #Frontend Admin by DynamiApps &lt;= 3.29.12 - Unauthenticated Account Takeover vi... 🔗 https://exploitgrid.net/cve/CVE-2026-75816

    Post summary

    The post highlights a high‑priority CVE-2026-75816 that permits unauthenticated account takeover in Frontend Admin (DynamiApps ≤3.29.12) and points to an ExploitGrid PoC, but does not report active exploitation, a patch, or a functional exploit tool.

    1000031
    40 followersView on X

Explore more

Back to dashboard