The Frontend Admin by DynamiApps plugin allows an attacker to delete arbitrary files on the server because the move_folders function lacks proper path validation. An attacker can target critical files such as wp-config.php, leading to remote code execution or other severe compromise. The vulnerability is a classic path traversal flaw (CWE-22).

This flaw exists in all released versions of the Frontend Admin by DynamiApps plugin up to and including 3.29.12. WordPress sites that have installed the plugin and use any form configured with public visibility (who_can_see='all') are affected. The plugin is widely deployed across WordPress installations, but the specific version range is limited to the aforementioned releases.

The CVSS score of 7.5 reflects a high severity. Although EPSS data is unavailable, the logic shows the flaw is exploitable without authentication when a public form is present, as the required nonce can be obtained from the rendered form. The flaw is not currently listed in CISA’s KEV catalog, but the potential for immediate remote code execution makes it a high‑priority issue. Exploitation requires only a browser or simple HTTP request configured against a public form, making it broadly accessible.