A critical authentication bypass vulnerability in the Frontend Admin by DynamiApps plugin allows unauthenticated attackers to gain full administrative control over the WordPress site.

This flaw involves an improper authentication check within the pre_update_value function and the ActionPost::conditions_logic method. An unauthenticated attacker can supply a non-numeric post ID to bypass authorization gates, allowing them to modify arbitrary user email addresses and subsequently reset passwords to achieve full account takeover.

The potential for total site compromise poses a severe risk to organizational data integrity, service availability, and administrative control. Given the CVSS score of 9.8, this vulnerability is classified as critical because it permits unauthenticated remote attackers to escalate privileges to the highest level, leading to unauthorized data access and potential malicious content injection.

Immediate Action: Update the Frontend Admin by DynamiApps plugin to version 3.29.13 or later immediately to incorporate the required authorization logic fixes.

Proactive Monitoring: Review WordPress user account logs for suspicious password resets or unauthorized modifications to administrator email addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious form submissions containing non-numeric identifiers in post ID parameters.

Public Exploit Available: Unknown

This vulnerability represents a high-risk entry point that can lead to complete site takeover without requiring any prior authentication. System administrators must prioritize the update to version 3.29.13 across all affected environments to mitigate this critical risk and prevent potential unauthorized access to administrative accounts.