Technical impact
The Frontend Admin plugin for WordPress lacks a capability check on the delete_object function, allowing any visitor to trigger deletion of posts, pages, products, taxonomy terms, and even user accounts. This results in direct data loss and integrity compromise. The flaw is classified as CWE-862, indicating a missing authorization control, and carries a CVSS score of 9.1, reflecting a high severity.
Affected Systems
WordPress sites using the Frontend Admin by DynamiApps plugin up to and including version 3.28.25 are affected. Sites that have not applied the 3.28.26 update or later are at risk.
Risk and Exploitability
Because the vulnerability permits access without authentication, any user on the public web interface can exploit it by submitting a delete_object request. The EPSS score is below 1%, suggesting current exploit pressure is low, yet the potential impact is severe. The flaw is not listed in the CISA KEV catalog, but the lack of an authorization check means an attacker could delete arbitrary content or accounts without restrictions. The likely attack vector is straightforward: craft a request to the delete_object endpoint from any browser or automated tool, bypassing role or capability checks.
