Vulnerability · Published Dec 3, 2025 · Assigned by Wordfence
CVE-2025-13342Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Critical 9.8
In plain English
A critical-severity missing authorization in Frontend Admin by DynamiApps from shabti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| shabti | Frontend Admin by DynamiApps | 0 – through 3.28.20 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H