A critical path traversal vulnerability in the Frontend Admin plugin for WordPress allows unauthenticated attackers to delete arbitrary server files, potentially leading to full remote code execution.

The plugin fails to perform adequate path validation within the move_folders function. This flaw allows an unauthenticated attacker to bypass security checks and delete arbitrary files, such as critical WordPress configuration files, when forms are configured with public visibility.

The ability to delete arbitrary files on a web server poses a severe risk to business operations and data integrity. Successful exploitation could lead to the deletion of wp-config.php, which would effectively take the website offline and potentially grant an attacker the ability to reconfigure the application to achieve remote code execution. Given the CVSS score of 7.5, this vulnerability represents a high-severity threat that could result in total system compromise and significant reputational damage.

Immediate Action: Update the Frontend Admin plugin to version 3.29.13 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Monitor server access logs for unusual requests targeting folder move or file deletion operations, particularly those originating from public-facing forms.

Compensating Controls: If an immediate update is not feasible, disable any forms using the plugin that are configured with public visibility (who_can_see='all') to prevent unauthenticated access to the vulnerable function.

Public Exploit Available: Unknown.

This vulnerability is highly critical due to its unauthenticated nature and the potential for remote code execution. Administrators should prioritize updating the Frontend Admin plugin to version 3.29.13 immediately. If the plugin is not actively required, removing it entirely from the environment is the most effective way to eliminate this risk.