CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
Explanation of Vulnerability in Simple Terms
Frontend Admin by DynamiApps versions 3.28.25 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify or delete site data over the network. No user interaction is required. The vulnerability affects data integrity and availability but not confidentiality.
What an attacker can do
Modify or delete site data without logging in.
Potential impact on your site
Attackers can alter or remove critical site content and functionality without credentials.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
