Privilege Escalation in Frontend Admin by DynamiApps Plugin for WordPress

The Frontend Admin by DynamiApps plugin for WordPress (versions 3.29.9 and earlier) contains a critical privilege escalation vulnerability. The issue originates in the ActionUser::conditions_logic() function, which performs an inadequate authorization check when validating user permissions. By providing a non-numeric string, such as '1one', to the item_id parameter within the wp_ajax_nopriv_frontend_admin/forms/change_form AJAX endpoint, attackers can bypass the current_user_can('edit_user', $user_id) check entirely. Because WordPress core logic subsequently coerces this non-numeric input to the integer '1' (which typically corresponds to the primary administrator account), an attacker can perform unauthorized actions against that account, such as modifying credentials or email addresses. Successful exploitation requires either an unauthenticated user to access a public-facing form or a low-privileged subscriber account to initiate the request.

Impact

Successful exploitation results in full administrative account takeover of the affected WordPress instance. This grants the attacker complete control over the site content, configuration, and potentially the underlying server environment, depending on installed plugins and server-side capabilities.

Recommendation

• Update the Frontend Admin by DynamiApps plugin to the latest version immediately to patch the logic in ActionUser::conditions_logic().
• If updating is not possible, disable the plugin and audit user account modifications for suspicious changes (e.g., unexpected email address or password updates).
• Monitor web server logs for high-frequency POST requests to wp-admin/admin-ajax.php that contain the query parameter action=frontend_admin/forms/change_form.