blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-3729

CRITICAL 9.8 CVSS 3.1
Published
May 2, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-636, CWE-754
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.

Affected WordPress components

  • Frontend Admin by DynamiApps Plugin · acf-frontend-form-element
    Confirmed match Active
    Up to and including 3.19.4
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • shabti Frontend Admin by DynamiApps — Up to and including 3.19.4
  • wordpress frontend_admin_by_dynamiapps — Up to and including 3.19.4
  • dynamiapps frontend_admin — Before 3.19.5

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.18.15/main/helpers.php#L617 Product
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3073379/acf-frontend-form-element#file4 Patch
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d22c5d-5ef5-4920-a1b5-e8284394c7e8?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record