The Frontend Admin by DynamiApps plugin for WordPress contains an authorization bypass that allows authenticated users with subscriber-level access or higher to overwrite key administrator fields such as password, email, first and last name. This flaw originates from failing to verify proper authorization when processing the user_id query parameter in the Edit-User form, which leads to a full administrator account takeover. The vulnerability is categorized as CWE‑862 Missing Authorization.

Affected products include the Frontend Admin by DynamiApps plugin, affecting all releases version 3.29.2 and earlier. The issue persists until a fixed version is released beyond the 3.29.2 threshold.

The CVSS score of 8.8 classifies this flaw as High severity. Exploitation requires the attacker to be authenticated with at least subscriber privileges and to target the Edit-User form whose 'Roles' setting is left empty; if the form is restricted to specific roles, the vulnerability is mitigated. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating current public exploitation may still be limited but the potential impact warrants immediate remediation.