Frontend Admin by DynamiApps < 3.28.26 - Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element

Description

The plugin is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.