Critical · published December 3, 2025
🚨 An unauthenticated attacker can modify crucial WordPress options with just a few crafted form submissions! Something as simple as a mischievous message can turn your site upside down! 🔥 Think of your website as a community library, where anyone can fill out a suggestion form. If the library staff doesn't check the forms before implementing the suggestions, someone could sneak in a request to change the opening hours or restrict access to certain books — chaos! 📚 This vulnerability could lead to unauthorized changes in critical settings like who can register on your site or even change your admin email, potentially locking you out entirely. An attacker could wreak havoc on your WordPress site, making it a playground for mischief and mayhem!
Think of your website as a community library, where anyone can fill out a suggestion form. If the library staff doesn't check the forms before implementing the suggestions, someone could sneak in a request to change the opening hours or restrict access to certain books — chaos! 📚 The Frontend Admin plugin for WordPress lacks proper capability checks and input validation in its ActionOptions::run() save handler, allowing unauthenticated users to submit malicious form data that modifies sensitive WordPress options.
This vulnerability could lead to unauthorized changes in critical settings like who can register on your site or even change your admin email, potentially locking you out entirely. An attacker could wreak havoc on your WordPress site, making it a playground for mischief and mayhem! Immediately update the Frontend Admin plugin to version 3.28.21 or later to patch this vulnerability. Additionally, review user roles and permissions, and consider implementing strict input validation on your forms to enhance security. You've got this! With these steps, you'll be protecting your WordPress site like a pro! 🛡️