The Frontend Admin plugin for WordPress fails to verify that a user is authorized to perform a password reset action, enabling subscribers or higher roles to reset any account password. This flaw provides attackers with full account takeover and the ability to compromise the entire site. The weakness is a classic missing authorization error (CWE‑862).

All WordPress sites running the Frontend Admin plugin by DynamiApps version 3.29.9 or earlier are impacted. No other vendors or products are listed as affected.

The vulnerability carries a high CVSS score of 8.8 and an EPSS rate of less than 1%, indicating that, while serious, it is not yet commonly exploited. The attack requires a legitimate authenticated session with subscriber+ privileges to obtain an encrypted Current‑User token from an Edit User form; the token is then used in a CBC bit‑flipping forgery to forcibly reset passwords. Because the exploit demands legitimate access and specific token data, the likelihood of successful exploitation is low but the potential impact is catastrophic.