Frontend Admin EUVD-2026-72044

Exploitation requires a WordPress site running Frontend Admin by DynamiApps <= 3.29.12 with at least one published, network-reachable frontend form that maps submissions to WordPress user records (a user-email/profile edit form). The attacker supplies a non-numeric post identifier (such as the string 'user_<id>', e.g. 'user_1' for the primary admin) to trigger the short-circuit in ActionPost::conditions_logic() that bypasses the current_user_can('edit_post') gate. No authentication, credentials, or user interaction are needed. The limiting factor is form exposure: if the plugin is installed but no user-record-editing form is published or the form endpoint is not reachable, the arbitrary-user write path is not exercised.

This scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), and the description strongly supports the high-severity reading: exploitation is network-based, requires no authentication, no user interaction, and works against default configurations wherever a Frontend Admin user-edit form is reachable. The primary realized impact is integrity and confidentiality (arbitrary account takeover, including administrator), which on WordPress cascades to full site compromise; the A:H metric is the weakest-supported element but is defensible given post-takeover control. No EPSS figure, CISA KEV entry, or public POC was provided, so exploitation probability cannot be quantified from the input - but the low complexity and the presence of source-level references pinpointing the vulnerable lines mean a working exploit is straightforward to reconstruct, so any operator running this plugin should treat it as urgent rather than waiting for confirmed in-the-wild activity. The one caveat worth verifying: successful attack requires a Frontend Admin form that maps submissions to user records to be published and reachable, so a site that only uses the plugin for post (not user) forms may have a narrower exposure than the raw score implies.

An attacker locates a WordPress site running Frontend Admin with a publicly reachable frontend form, then submits a crafted request that sets the target identifier to 'user_1' (the default administrator) and supplies an attacker-controlled email address. Because the edit_post capability check is short-circuited on the non-numeric ID, the admin's email is overwritten without authentication; the attacker then triggers WordPress's lost-password flow, receives the reset link at their own inbox, and takes full control of the administrator account. No public POC was identified, but the referenced source lines make reconstruction trivial.