VULNERABILITY INTELLIGENCE
CVE-2026-81347
CVSS score5.9 MEDIUM
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-08
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-73