A directory traversal flaw in Frontend Admin by DynamiApps allows an attacker to manipulate a user‑supplied directory path before file deletion occurs. The flaw permits deletion of index.php and ".htaccess" files located outside the intended working directory, including files in the WordPress root. If an attacker succeeds, the web site becomes inoperable because these files are essential for the normal rendering of pages and the handling of HTTP requests. The vulnerability provides no direct data exfiltration or code execution, but it can fully disrupt availability.

WordPress sites using the Frontend Admin by DynamiApps plugin version earlier than 3.29.13. The vulnerability affects all installations that have enabled the plugin’s custom directory path functionality and a non‑default configuration, as the deletion operation is only triggered when this configuration is in use.

The CVSS score is 5.9, indicating a moderate severity. The attack can be performed unauthenticated over HTTP, making it a threat to availability. The EPSS score is <1%, suggesting low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would craft a malicious request to the plugin’s deletion endpoint, supplying a controlled directory path like "../../.." to traverse to the WordPress root and then delete the targeted files. Successful exploitation requires that the site has a non‑default form configuration, which is common in many deployments that customize the plugin’s settings.