# CVE-2026-81346: Frontend Admin by DynamiApps privilege escalation in membership plan deletion

Source: https://junglewise.ai/threats/cve-2026-81346-frontend-admin-by-dynamiapps-privilege-escalation-in-membership  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81346 · Severity: medium · CVSS 4.3 · Published 2026-08-29

The Frontend Admin by DynamiApps WordPress plugin provides a membership management system for website administrators. A flaw in the plugin allows any authenticated user—including those with minimal permissions like subscribers—to delete arbitrary membership plans via an unprotected AJAX action, disrupting business operations and data integrity.

Technologies: [DynamiApps Frontend Admin](https://junglewise.ai/threats/technologies/frontend-admin). Vendors: [DynamiApps](https://junglewise.ai/threats/vendors/dynamiapps).

## Quick answers

**Is CVE-2026-81346 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81346 being exploited in the wild.

**How severe is CVE-2026-81346?** Medium severity, with a CVSS score of 4.3, published 29 August 2026.

**Which products and versions are affected?** DynamiApps Frontend Admin before 3.29.11.

**Is there a fix for CVE-2026-81346?** A patch was published on 2026-08-27: Fixed in version 3.29.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81346 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81346?** Check whether you run DynamiApps Frontend Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in an AJAX action handler for membership plan deletion. The plugin fails to verify whether the user has the required capability to perform the action, relying only on WordPress authentication (an authenticated user must be logged in). An attacker must be an authenticated user with access to a page rendering a Frontend Admin form to obtain the nonce, then can craft an AJAX request to the "frontend_admin/plans/delete" action to delete arbitrary membership plans by ID. The vulnerability was fixed in version 3.29.11.

## Affected products

- DynamiApps Frontend Admin before 3.29.11

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 3.29.11
- 2026-08-29: advisory

## References

- [https://wpscan.com/vulnerability/0fee8405-24c3-470e-b16d-7c839cba6038/](https://wpscan.com/vulnerability/0fee8405-24c3-470e-b16d-7c839cba6038/)

## Related threats

- [DynamiApps Frontend Admin stored XSS vulnerability](https://junglewise.ai/threats/cve-2026-119504-improper-neutralization-of-input-during-web-page-generation)
- [DynamiApps Frontend Admin privilege escalation in acf-frontend-form-element](https://junglewise.ai/threats/cve-2026-119506-incorrect-privilege-assignment-vulnerability-in-dynamiapps)
- [Frontend Admin by DynamiApps SQL injection](https://junglewise.ai/threats/cve-2026-42722-administrator-sql-injection-in-frontend-admin-by-dynamiapps-3-29)
- [Frontend Admin by DynamiApps stored XSS via kses bypass](https://junglewise.ai/threats/cve-2026-6243-the-frontend-admin-by-dynamiapps-plugin-for-wordpress-is)
- [DynamiApps Frontend Admin authentication bypass to account takeover](https://junglewise.ai/threats/cve-2026-75816-dynamiapps-frontend-admin-authentication-bypass-to-account)