Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows unauthenticated attackers to bypass security checks and take over any user account, including administrator accounts, by overwriting their email addresses and initiating a password reset. This issue affects all versions of the plugin up to and including 3.29.12.
- Unauthenticated users can take over accounts.
- Critical for controlling website access.
- Confirm plugin relevance and verify exposure.
Attack Path
How an attacker could exploit the issue
An attacker can bypass authentication to take over any user account by submitting a crafted form. This attack begins with unauthenticated access to a vulnerable WordPress site. The attacker targets the Frontend Admin by DynamiApps plugin, specifically its ability to update user records. By providing a non-numeric post ID, the attacker can trick the plugin into processing a form submission that changes a user's email address. Once the email is changed, the attacker can then initiate a password reset to gain full control of the account.
- No prior access required to initiate.
- Submitting a specially crafted form.
- Account takeover via email and password reset.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to change the email address associated with any user account on a WordPress site, including administrator accounts. This could then be used to initiate a password reset and gain full control of the targeted account.
- User account email addresses.
- Unauthenticated form submissions bypass checks.
- Account takeover via password reset.
Operational Fix
Recommended remediation, mitigation, and detection steps
Website administrators and application owners are responsible for addressing this vulnerability, which allows unauthenticated attackers to bypass authentication and take over accounts by overwriting user email addresses and exploiting the password reset flow. The first practical step is to identify all instances of the affected WordPress plugin, assess their exposure and business criticality, and then prioritize remediation efforts.
- Ownership: WordPress administrators and plugin owners.
- Verify first: Plugin presence and external reachability.
- Action: Plan and coordinate maintenance for remediation.
