The Frontend Admin by DynamiApps plugin for WordPress contains a generic SQL Injection flaw (CWE‑89) in its handling of the 'order' parameter. The plugin concatenates the value of this parameter directly into an SQL query without proper escaping or parameterization, enabling an attacker who is logged in with administrator‑level privileges and supplies a valid 'orderby' argument, to inject and execute arbitrary SQL statements. Successful exploitation could result in the unauthorized extraction of sensitive data from the database, compromising confidentiality.

This vulnerability affects all releases of the Frontend Admin by DynamiApps plugin up to and including version 3.28.28. WordPress users who deploy any of those versions are susceptible until the plugin is updated to a fixed version. No other vendors or products are listed as impacted by the CNA.

The CVSS base score of 4.9 indicates a moderate severity; the EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated administrator access and the provision of both 'order' and 'orderby' parameters, its exploitation is limited to trusted users with high privileges. Nevertheless, an attacker with such access can potentially read or exfiltrate database contents, making the risk significant within the affected environment.