A high-severity privilege escalation vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows authenticated users to gain unauthorized administrative access.

The plugin suffers from improper privilege management (CWE-269). While the initial report noted "unauthenticated" access, the CVSS vector (PR:L) indicates that an attacker must possess at least low-level privileges to exploit this flaw and manipulate user roles.

Successful exploitation allows an attacker to elevate their account permissions to administrative levels. This could lead to a total compromise of the WordPress site, including data theft, unauthorized content modification, and potential server-side execution. With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected platform.

Immediate Action: Update the "Frontend Admin by DynamiApps" plugin to version 3.29.3 or later immediately to resolve the privilege management flaw.

Proactive Monitoring: Review WordPress user account activity logs for unexpected account creation or unauthorized privilege changes, particularly among low-privileged users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific PHP classes involved in user role management.

Public Exploit Available: No

Given the potential for full administrative takeover, organizations utilizing this plugin must prioritize the update to version 3.29.3. If an immediate update is not feasible, consider deactivating the plugin until a patch is applied to mitigate the risk of unauthorized privilege escalation.