What is the CVSS score of CVE-2025-13342?

CVE-2025-13342 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-13342?

An unauthenticated attacker can modify critical WordPress configuration settings through a vulnerable plugin, potentially enabling unauthorized user registration, changing administrator email…

How to fix or mitigate CVE-2025-13342?

Within 24 hours: Identify all WordPress instances using Frontend Admin plugin by DynamiApps and isolate affected sites from production traffic if possible. Within 7 days: Disable or remove the vulnerable plugin across all instances; audit WordPress option tables for unauthorized modifications (users_can_register, default_role, admin_email, siteurl, home); review access logs for suspicious form submissions. Within 30 days: Implement Web Application Firewall (WAF) rules to block crafted requests to plugin endpoints; migrate to alternative admin frontend solutions; establish plugin inventory and vulnerability scanning process.

PHP CVE-2025-13342

EUVD-2025-200979 CRITICAL

Missing Authorization (CWE-862)

2025-12-03 security@wordfence.com

Authentication Bypass WordPress PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:14 euvd

EUVD-2025-200979

Analysis Generated

Mar 15, 2026 - 16:14 vuln.today

CVE Published

Dec 03, 2025 - 13:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.