CVE-2026-81346

The Frontend Admin plugin for WordPress, prior to version 3.29.11, lacks proper capability checks on its AJAX actions, enabling any authenticated user, including those with minimal privileges like subscribers, to delete arbitrary membership plans. This vulnerability could lead to unauthorized modifications of membership configurations, potentially disrupting service and affecting user access. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.