What the vulnerability does
01Description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
Explanation of Vulnerability in Simple Terms
02Summary
Frontend Admin by DynamiApps versions 3.28.20 and earlier lack proper authorization checks, allowing unauthenticated attackers to access sensitive functionality and data. An attacker can read, modify, or delete site content without logging in. This affects all installations of the plugin without a security update.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data and settings without authentication.
Potential impact on your site
04Site Impact
Attackers can compromise your site's data, settings, and content without needing valid credentials.
Conditions required to exploit
05Prerequisites
Network access to the site; no login or user interaction required.
Key dates
06Disclosure timeline
December 3, 2025
CVE published
April 8, 2026
Record updated
