This flaw is particularly dangerous because it is exploitable by unauthenticated users when a form is configured with public visibility settings (who_can_see='all'). In such cases, the nonce required to perform the action is exposed within the rendered form, allowing attackers to bypass standard authorization checks. Successful exploitation involves sending a crafted request to the plugin's endpoint, which, if successful, can lead to the deletion of sensitive files such as 'wp-config.php'. The removal of such core configuration files can trigger re-installation flows or expose database credentials, ultimately enabling an attacker to gain remote code execution or complete system compromise.

Impact

The vulnerability poses a severe risk to WordPress installations utilizing the Frontend Admin plugin. If exploited, an attacker can delete arbitrary files, leading to site defacement, service disruption, or total system compromise via remote code execution. The exploit is accessible to unauthenticated remote attackers, making it a high-priority target for automated scanning and mass exploitation efforts.

Recommendation

• Update the Frontend Admin plugin to a version released after 3.29.12 immediately to incorporate necessary input validation patches.
• Audit all forms configured within the Frontend Admin plugin and restrict visibility settings from 'all' to authenticated roles until the update is applied.
• Monitor web server access logs for anomalous POST requests targeting the plugin's path and 'move_folders' related parameters.
• Verify file system integrity for critical WordPress files such as 'wp-config.php' and '.htaccess'.