Description

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-29T06:18:02.633Z",
  "pubdate": "2026-08-29T06:18:02.633Z",
  "executiveSummary": "The Frontend Admin WordPress plugin, in versions prior to 3.29.11, contains a critical Broken Access Control vulnerability that permits unauthorized data modification.\nThe flaw stems from a lack of capability validation within a specific AJAX action handler, enabling authenticated users, regardless of their role or administrative privileges, to delete arbitrary membership plans managed by the plugin.\nThis vulnerability constitutes an Insecure Direct Object Reference (IDOR) or a missing function-level access control issue, allowing any authenticated subscriber to disrupt the availability and integrity of the plugin's membership configuration.\nSuccessful exploitation requires the attacker to hold an authenticated session on the target WordPress site. The primary risk involves the unauthorized destruction of business-critical data, leading to potential service disruption, loss of membership revenue, and administrative overhead due to data recovery requirements.\nGiven the nature of the exploit, it does not require administrative escalation but rather exploits an oversight in the plugin's internal authorization framework, making it a significant security risk for any site leveraging the affected version.",
  "technicalDetails": "The vulnerability originates within the backend processing logic of the Frontend Admin plugin, specifically within its AJAX endpoint architecture. In affected versions (below 3.29.11), the code responsible for processing membership plan deletion requests fails to implement a robust capability check using WordPress's current_user_can() function or equivalent authorization middleware.\nThe root cause is a failure to verify the session user's administrative role before executing the deletion query on the underlying database. In the WordPress security model, AJAX actions registered via the 'wp_ajax_' hook should explicitly validate the caller's permissions to ensure only authorized administrators can perform destructive operations.\nThe attack flow proceeds as follows: An attacker with a low-privileged account, such as a 'Subscriber,' initiates a request to the WordPress admin-ajax.php endpoint. By including the specific action identifier associated with the plugin's plan management feature and providing the target unique identifier (ID) of the membership plan in the request body, the attacker forces the plugin's backend logic to process the deletion.\nBecause the server-side handler omits access control logic, it processes the request under the context of the current user's session. The plugin proceeds to execute SQL operations or internal API calls to remove the specified membership plan from the database. The attacker does not need to bypass CSRF protections if the application does not implement nonce validation alongside the missing capability check, further simplifying the exploit chain.\nThe technical impact is the unauthorized deletion of arbitrary records. Because the application trusts the input provided in the AJAX request without verifying if the user has the 'manage_options' or equivalent capability, the attacker can iterate through IDs to purge multiple plans. Post-exploitation, the impact involves total loss of membership data associated with those plans, potential service outages for users subscribed to the deleted plans, and potential financial impact if the plugin integrates with payment gateways for those specific membership levels. The vulnerability is localized to the plugin's AJAX handler and does not require remote code execution to achieve the described unauthorized modification."
}