Frontend Admin by DynamiApps Privilege Escalation via Non-Numeric User ID Bypass

Technical Analysis

The vulnerability resides in `ActionUser::conditions_logic()`, where the `current_user_can('edit_user', $user_id)` capability check is only executed if `is_numeric($user_id)` returns true. By submitting a crafted non-numeric string (e.g., '1one') as the `item_id` parameter to the `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint, an attacker bypasses the authorization check entirely. WordPress subsequently coerces the non-numeric value to integer 1 during internal processing, which corresponds to the default administrator account, allowing the attacker to overwrite its password or email and seize control. Exploitation as an unauthenticated user requires a public-facing frontend user form to be configured; otherwise, a low-privileged subscriber account is sufficient. This is a standalone WordPress CMS plugin flaw with no direct AI agent runtime component, but if compromised WordPress instances are used as content sources for RAG pipelines or as backend admin panels managed by AI agent automation tools, attacker-controlled admin access could enable injection of malicious content or credentials harvesting affecting downstream agent workflows.

Affected Systems

Frontend Admin by DynamiApps WordPress plugin, all versions up to and including 3.29.9; WordPress sites with the plugin's frontend user form feature enabled (public-facing or authenticated subscriber access)

Indicators of Compromise

• No specific IOCs published; monitor for anomalous requests to wp-admin/admin-ajax.php with action=frontend_admin/forms/change_form and non-numeric item_id parameter values (e.g., '1one')

Remediation Steps

1. 1

   Update the plugin

   Upgrade Frontend Admin by DynamiApps to a patched version beyond 3.29.9 as soon as it is released by the vendor.

2. 2

   Disable frontend user forms

   If a patch is not yet available, disable or restrict public-facing frontend user edit forms to reduce unauthenticated exposure.

3. 3

   Monitor AJAX endpoint traffic

   Implement WAF rules or logging to detect and block requests to wp_ajax_nopriv_frontend_admin/forms/change_form containing non-numeric item_id values.

4. 4

   Audit administrator accounts

   Review administrator account credentials and recent password/email changes for signs of compromise, especially for user ID 1.

5. 5

   Enforce least privilege

   Limit subscriber-level registrations and review user roles to minimize the pool of accounts capable of triggering the exploit.