External risk intelligence

Frontend Admin for WordPress plugin allows unauthenticated modification of site options.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13342

The vulnerability exists in a WordPress plugin that exposes functionality via public-facing frontend forms. Since these forms are designed to be accessible to visitors on the public internet without authentication, the vulnerable attack surface is inherently and intentionally internet-facing by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a WordPress plugin, allowing unauthenticated attackers to alter critical site settings like user registration and administrator email addresses. The potential for unauthorized configuration changes poses a risk to website integrity and operation. The main concern is confirming relevance and exposure.

Attackers can change important website settings.
This could impact website control and user access.
Verify if this plugin is in use on your sites.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted data to public frontend forms managed by the Frontend Admin plugin. Because the plugin lacks proper checks on user permissions and sanitizes input inadequately, an unauthenticated attacker can alter core WordPress settings like user registration or the administrator's email address, potentially leading to unauthorized control or disruption.

Unauthenticated access to public forms.
Submission of crafted form data.
Unauthorized modification of critical options.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to modify critical WordPress settings, like user registration and administrator email, through crafted form submissions on public-facing pages.

WordPress options could be altered.
Unauthenticated users submit crafted forms.
Site control and email may be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the WordPress Frontend Admin plugin requires immediate attention from teams managing WordPress sites. The first step is to locate all instances of this plugin, determine if they are exposed externally or host business-critical data, and identify the accountable owner for each site. Once identified, a risk-based remediation plan should be developed, which may involve coordination with the plugin vendor or implementation of temporary mitigations.

WordPress site owners should own this.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Frontend Admin plugin for WordPress?

Frontend Admin by DynamiApps is a WordPress plugin designed to let site administrators surface specific dashboard functionality on the public-facing side of a website. It allows users to interact with or manage site data through forms without needing direct access to the WordPress backend. It is commonly used to build custom front-end interfaces for user submissions, content management, or site settings.

How does CVE-2025-13342 work?

This vulnerability is categorized as a Missing Authorization issue (CWE-862). It occurs because the plugin's save handler, ActionOptions::run(), fails to verify if the person submitting the form has the necessary permissions. Because the code also lacks proper input validation, an attacker can provide unauthorized data to the form, allowing them to overwrite sensitive WordPress core settings, such as who is allowed to register or which email address receives administrative notifications.

Do I need to be logged in to trigger this vulnerability?

No. The flaw specifically allows unauthenticated individuals to execute the malicious change. The vulnerability exists within public-facing forms that are designed to be accessible to any visitor. If you have forms configured that do not require a login, they may be susceptible to this crafted data submission. Accessing private or admin-only areas of the site is not required for an attacker to reach the vulnerable code path.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin, your site is considered to have an internet-facing attack surface. Because the plugin is designed to present forms directly on public web pages, it is inherently reachable from the public internet. Halo Surface Signal identifies this as a high-relevance scenario, meaning any instance of this plugin running on a public-facing WordPress site is effectively exposed to potential interaction from the outside.

What should I do if I use Frontend Admin?

Your first step is to perform an inventory of your WordPress installations to confirm if the Frontend Admin plugin is present and active. Once identified, evaluate the necessity of the plugin on those sites and determine who is responsible for their maintenance. Given the nature of the flaw, you should consider disabling the plugin or removing the affected frontend forms immediately while you coordinate with the vendor for a security update or implement other risk-based mitigations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.