An improper neutralization of special elements in an SQL command allows a blind SQL injection in the WordPress plugin "Frontend Admin by DynamiApps". The flaw enables an attacker to issue arbitrary SQL statements and extract data from the underlying database without direct error messages. This can lead to disclosure of sensitive information and compromise of the website’s confidentiality and integrity, potentially enabling further attacks if the attacker gains additional privileges. The vulnerability is identified as CWE‑89 and is not a direct remote code execution flaw, but it can serve as a foothold for more dangerous exploits.

The vulnerability affects the "Frontend Admin by DynamiApps" plugin for WordPress versions up to and including 3.28.3. All installations running 3.28.3 or older are susceptible. No other product versions or vendors are listed as affected in the current advisory.

The CVSS score of 8.5 signals high severity. The EPSS score of less than 1% indicates a currently low likelihood of exploitation, and the flaw is not present in the CISA KEV catalog. The likely attack vector is through the plugin’s front‑end forms or query parameters that pass unsanitized input to SQL statements. An attacker with access to the public website could craft carefully crafted requests to trigger the blind injection and retrieve information from the database.