The Frontend Admin by DynamiApps WordPress plugin (versions <=3.29.9) contains a privilege escalation vulnerability (CWE-269) due to improper privilege management. The function ActionUser::conditions_logic() gates the authorization check current_user_can('edit_user', $user_id) behind an is_numeric() test. When a non-numeric string is passed as $user_id (e.g., '1one'), the authorization check is skipped. This can be triggered via the unvalidated item_id parameter in the unauthenticated wp_ajax_nopriv_frontend_admin/forms/change_form AJAX endpoint. An attacker can obtain a server-signed _acf_objects payload carrying the crafted user ID, which WordPress coerces to integer 1 (the default administrator user ID), enabling the attacker to overwrite the administrator account's password or email address. Exploitation requires a public-facing frontend user form or subscriber-level access otherwise.

Successful exploitation allows unauthenticated attackers (if a public frontend user form is configured) or subscriber-level users to escalate privileges to administrator. This enables full control over the WordPress site by overwriting the administrator account's password or email, leading to complete compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable public-facing frontend user forms if possible and monitor for unusual activity related to the affected AJAX endpoint. Avoid exposing the vulnerable plugin or upgrade promptly once a patch is released.