Frontend Admin EUVD-2026-68065

Exploitation requires a valid WordPress account at any role level, including subscriber - the lowest default WordPress role. Sites with open user registration are most exposed, as an attacker can self-register without prior access. Sites with closed registration limit exploitation to existing authenticated users, significantly narrowing the realistic attacker pool. No special plugin configuration, non-default settings, or specific deployment topology is required beyond having the Frontend Admin by DynamiApps plugin installed and active. The vulnerability is scoped exclusively to deletion of membership plans; it does not provide file system access, code execution, privilege escalation, or data exfiltration. Unauthenticated requests to the AJAX endpoint will not succeed, as WordPress rejects wp_ajax_* hook invocations from unauthenticated sessions.

The CVSS 4.3 Medium score accurately reflects the constrained scope: network-delivered with low complexity, but exploitation requires at minimum a subscriber-level credential (PR:L), and the impact is limited strictly to integrity with no confidentiality or availability components in the base score. The EPSS score of 0.13% (3rd percentile) is notably low despite the existence of a public proof-of-concept, suggesting awareness in the research community has not translated into broad scanning or exploitation campaigns. No CISA KEV listing is present, consistent with the low EPSS signal. The real-world risk is context-dependent: on sites where membership plans govern billing or access control, their deletion could cause significant operational disruption disproportionate to the CVSS score alone. Sites with open user registration face the highest exposure since attackers can self-register a qualifying account; sites with closed registration restrict the attacker pool to existing authenticated users, which meaningfully reduces the realistic threat surface. The public POC lowers the skill barrier for exploitation, making prompt patching advisable despite the low EPSS.

An attacker self-registers a subscriber account on a WordPress site with open registration and the vulnerable plugin active, then sends a crafted HTTP POST to /wp-admin/admin-ajax.php specifying the unprotected membership deletion action. Because no capability check is performed server-side, the targeted membership plans are permanently deleted. A publicly available proof-of-concept reduces the technical skill required for this attack.