CVE-2025-13342
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
| CWE | CWE-862 |
| Vendor | shabti |
| Product | frontend admin by dynamiapps |
| Published | Dec 3, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for shabti frontend admin by dynamiapps
Be the first to know when new critical vulnerabilities affecting shabti frontend admin by dynamiapps are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
shabti / Frontend Admin by DynamiApps
0 ≤ 3.28.20
References
Credits
JEONG YU CHAN