Executive brief
The Frontend Admin by DynamiApps plugin for WordPress allows unauthenticated attackers to take over any WordPress account, including administrator accounts, by bypassing authentication checks. An attacker can change a victim's registered email address through a form submission and then reset the account password, gaining full control of the account and potentially the entire WordPress site.
Technical details
The vulnerability is an authentication bypass in the pre_update_value function and ActionPost::conditions_logic() method that fails to validate user capabilities or ownership when processing form submissions. The vulnerability is triggered when a post ID parameter is non-numeric (e.g., the string "user_1"), which causes the current_user_can('edit_post') authorization check to be short-circuited. This allows unauthenticated attackers to submit form data that modifies arbitrary user records, specifically the registered email address. By changing an administrator's email and then triggering WordPress's password reset flow, an attacker can fully compromise the targeted account. The vulnerability affects all versions up to and including 3.29.12; patches are expected in later versions.
Affected products
- DynamiApps Frontend Admin up to and including 3.29.12
Timeline
- 2026-09-06: disclosed