The Frontend Admin by DynamiApps WordPress plugin allows an unauthenticated attacker to register as an administrator because the plugin fails to properly validate role inputs in internal validation, pre_update, and display functions. This flaw, identified as CWE‑269 (Improper Control of Privileged Access), directly enables an attacker to gain full site control, compromising confidentiality, integrity, and availability for the entire WordPress installation.

All users of the Frontend Admin by DynamiApps plugin running WordPress, with any installation of version 3.28.29 or earlier, are affected. The vulnerability is present in every build up to and including 3.28.29 and thus applies to all sites that have not upgraded beyond that release.

The CVSS score of 9.8 indicates a critical severity level, yet the EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog. The attack requires access to a user registration page that contains a Role field; any visitor who can submit the form with arbitrary role data can promote themselves to administrator. Because the attacker can achieve this without authentication, the risk to organizations that expose such forms is substantial, but the low exploitation probability mitigates immediate concern.