Executive brief
The Frontend Admin by DynamiApps WordPress plugin provides a membership management system for website administrators. A flaw in the plugin allows any authenticated user—including those with minimal permissions like subscribers—to delete arbitrary membership plans via an unprotected AJAX action, disrupting business operations and data integrity.
Technical details
The vulnerability is a missing authorization check (CWE-862) in an AJAX action handler for membership plan deletion. The plugin fails to verify whether the user has the required capability to perform the action, relying only on WordPress authentication (an authenticated user must be logged in). An attacker must be an authenticated user with access to a page rendering a Frontend Admin form to obtain the nonce, then can craft an AJAX request to the "frontend_admin/plans/delete" action to delete arbitrary membership plans by ID. The vulnerability was fixed in version 3.29.11.
Affected products
- DynamiApps Frontend Admin before 3.29.11
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 3.29.11
- 2026-08-29: advisory