The Frontend Admin by DynamiApps WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) via the 'orderby' parameter due to insufficient escaping and lack of prepared statements in SQL queries. This flaw permits unauthenticated attackers, who have permission to view form submissions and where the form submission shortcode is used, to append malicious SQL code to existing queries. This can result in unauthorized extraction of sensitive information from the database. The vulnerability affects all versions up to and including 3.25.1. The CVSS 3.1 base score is 5.9, indicating medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. There is no vendor advisory or patch information currently available.

An attacker can exploit this vulnerability to extract sensitive information from the database without authentication, provided they have permission to view form submissions and the form submission shortcode is active on a page. The confidentiality of data is impacted, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict permissions to view form submissions to trusted users only and consider removing or disabling the form submission shortcode on publicly accessible pages to reduce exposure.