The Frontend Admin by DynamiApps WordPress plugin contains an improper authorization check that permits unauthenticated users to alter privileged account settings. A request to the wp_ajax_nopriv_frontend_admin/forms/change_form endpoint can supply a non‑numeric user identifier such as “1one”; the code then skips the current_user_can('edit_user'…) verification and WordPress coerces the string to the integer value 1, which is the default administrator. The attacker can consequently overwrite the administrator’s password or email address, gaining full control of the site. This flaw is a classic example of improper privilege management (CWE-269) and results in total loss of confidentiality, integrity, and availability for the affected WordPress installation.

All installations of the Frontend Admin by DynamiApps WordPress plugin at versions 3.29.9 or earlier are vulnerable. Any WordPress site that has the plugin active and a public‑facing form configured, whether for a small blog or a larger organization, is at risk.

With a CVSS score of 9.8, the vulnerability is of very high severity. No authentication is required to exploit it; the attacker only needs to send a crafted AJAX request to the publicly accessible wp_ajax_nopriv_frontend_admin/forms/change_form endpoint, using a crafted item_id value such as “1one”. Because the flaw is straightforward to trigger and no additional preconditions are needed beyond a public‑facing form, the likelihood of exploitation is high. The EPSS score is not available, but the absence of a KEV listing does not diminish the risk. Once an administrator account is hijacked, an attacker can delete, modify, or exfiltrate site data, causing a full compromise.