A critical authentication bypass vulnerability has been disclosed in the Frontend Admin plugin for WordPress, affecting all versions up to and including 3.29.12. An unauthenticated attacker can overwrite any user's registered email address, including a site administrator's, and then use WordPress's own password-reset flow to fully take over the account. No credentials required.

The root cause is two related failures, not one. First, the pre_update_value function skips capability and ownership checks entirely. Second, the ActionPost::conditions_logic() method has an authorization gate built around current_user_can('edit_post') that gets bypassed whenever the post ID is non-numeric. Feed it a string like user_1 instead of an integer, and the check short-circuits. You end up with unauthenticated form submissions routed directly to arbitrary user records. The full CVE detail is on NVD.

This is a textbook authorization logic flaw, not a flashy exploit. The plugin accepted external input, used it to resolve an identity, and never confirmed that the caller had any right to modify that identity. What I've seen repeatedly in IAM work is that developers treat authentication and authorization as a single gate at the front door. They're not. You can be fully unauthenticated and still reach deep backend logic if the authorization checks inside individual functions are missing or poorly structured. Every function that touches identity data needs its own ownership and capability validation, regardless of how the request got there.

For WordPress environments specifically, the concern isn't just the account takeover itself. It's the blast radius. Admin-level account compromise on WordPress typically means full site access, which on a shared or enterprise installation can include SSO integrations, stored API credentials, and webhook configurations that touch other systems. One overwritten email address becomes a pivot point into a much larger environment.

If you're running Frontend Admin by DynamiApps, update to a patched version immediately. If you can't patch right now, disable the plugin until you can. Beyond that, audit your WordPress admin accounts for unexpected email address changes in the recent activity log. If you have SIEM or log aggregation pulling WordPress audit events, search for email modification events tied to admin-level user IDs, especially any that weren't triggered through your normal identity lifecycle process. That's your Monday morning starting point.