The Frontend Admin by DynamiApps plugin allows an unauthenticated attacker to override any WordPress user’s email address through an unvalidated form submission. By sending a crafted request that sets a non‑numeric post ID such as "user_1", the plugin bypasses its authentication checks and writes the new email value. Once the email is replaced, the attacker can use the standard WordPress password‑reset mechanism to gain full control of the target account. This is an authentication bypass vulnerability (CWE‑287) that can lead to complete administrative takeover.

WordPress sites that have the Frontend Admin by DynamiApps plugin installed in any version up to and including 3.29.12 are affected. The issue exists in all releases prior to 3.30, regardless of other plugin settings, because the vulnerable code paths lack owner or capability validation.

With a CVSS score of 9.8, the flaw is considered critical. Although the EPSS score is not provided, the absence of a mitigation recommendation and the high CVSS score suggest that attacks are both feasible and potentially common. The vulnerability is not listed in the CISA KEV catalog, but the lack of an authentication gate keeps the attack vector open to any user who can submit a form to the plugin’s endpoint. A successful exploitation can result in the attacker taking complete control of an administrator’s account, with full confidentiality, integrity, and availability impact on the entire WordPress installation.