The Frontend Admin by DynamiApps WordPress plugin suffers from improper privilege management (CWE-269) due to inadequate validation of role parameters in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This allows unauthenticated attackers to escalate privileges by registering as administrators through a user registration form that includes a Role field. The vulnerability affects all plugin versions up to and including 3.28.29 and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact.

An unauthenticated attacker can exploit this vulnerability to register as an administrator on the affected WordPress site, gaining complete control over the site. This includes the ability to modify content, install malicious plugins, and compromise site integrity and availability. The impact is critical due to full system compromise without any authentication or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to any user registration forms containing a Role field or disable such forms entirely. Monitor for updates from DynamiApps regarding a security patch and apply it promptly once available.