Read the docs
TI-2026-56162 Aliases CVE-2026-81347GHSA-2xpp-ph6f-9hw6

Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion…

Priority LOW 27CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-73 and the CVSS impact.

Summary

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00381 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Frontend Admin by DynamiApps (Unknown): 3.29.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFrontend Admin by DynamiAppsbefore 3.29.133.29.13Patch availableCNA
  • Frontend Admin by DynamiApps VendorUnknown Affected before 3.29.13 Fixed in 3.29.13 Patch available CNA

Remediation

  • Fix · CNA Frontend Admin by DynamiApps (Unknown) Fixed in 3.29.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81347
  2. 2026-10-03 Alias added: GHSA-2xpp-ph6f-9hw6

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences