CVE-2026-81347
Medium
Description
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
SeverityMedium
CVSS5.9
Exploit probability—
ProductFrontend Admin by DynamiApps
PublishedSep 4, 2026
First seenSep 4, 2026
Weakness typeCWE-73CWE-73
How to fix
Update
- Frontend Admin by DynamiApps3.29.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Frontend Admin by DynamiApps | v < 3.29.13 | 3.29.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.