The Frontend Admin by DynamiApps WordPress plugin, versions prior to 3.29.11, performs a membership plan deletion through an AJAX action without checking whether the user has the proper capability. Because this action is available to any authenticated user, even site subscribers, an attacker can trigger the deletion of any membership plan that the site administrator has created. The removal of a plan deletes definition from the database, invalidating any entitlements or billing logic that depended on that plan and potentially disrupting the site’s subscription model.

WordPress installations that install the Frontend Admin by DynamiApps plugin and are running a version earlier than 3.29.11 are affected. The vulnerability applies to all prior releases for which the capability check is missing; all older versions should be regarded as potentially vulnerable because no sub‑version updates are specified.

An authenticated user with subscriber role can send a crafted AJAX request to the vulnerable endpoint and delete a membership plan. The exploit requires no elevated server privileges, can be performed remotely over the web, and does not need specific network or local access. The CVSS score of 4.3 reflects a moderate severity due mainly to the limited impact of plan deletion. The EPSS score of less than 1% and its absence from the CISA KEV catalog indicate a low likelihood of widespread exploitation, though the flaw is trivial for a legitimate user to use.