A flaw in the Frontend Admin plugin allows users with editor privileges to misconfigure a form that edits user roles. The plugin’s form configuration can be crafted so that the array of allowed roles lists "administrator". When the form is submitted, the code merely checks that the chosen role exists in this array and fails to verify that the current user is authorized to assign it, enabling elevation to administrator. The vulnerability resides in CWE‑269 (Improper Privilege Management). Consequently, an attacker can acquire full administrative control of a WordPress site.

WordPress sites running the Frontend Admin by DynamiApps plugin up to and including version 3.28.36 are impacted. No specific supplemental product information is supplied, so any installation of this plugin version chain is considered vulnerable.

The CVSS score of 8.8 signals a high‑severity threat. Although the EPSS score is not available, the absence of a listing in the CISA KEV catalog suggests that no publicly known exploits are currently documented. The likely attack vector is a combination of unauthenticated user registration via the plugin’s public new_user form followed by authenticated form creation and submission. Once the attacker registers as an editor, they can craft a privileged edit_user form and exploit the lack of authorization checks to gain administrator rights. Given the plugin’s broad permissions for editors, the risk remains significant if the plugin remains outdated and publicly accessible.