Critical · published January 9, 2026
🚨 Unauthenticated attackers can delete anything they want! The Frontend Admin plugin for WordPress lacks proper checks, letting intruders wipe out posts, pages, and even your user accounts! 🔥 Think of this as a restaurant where anyone can walk into the back kitchen and toss out any dish they dislike without anyone stopping them — absolutely chaotic! 🍽️ This vulnerability means anyone can play chef with your site's content. An attacker could stroll in and delete critical components of your site, leading to loss of content, broken links, and potentially shutting down your business. Picture waking up to an empty menu after someone cleared it out overnight — devastating!
Think of this as a restaurant where anyone can walk into the back kitchen and toss out any dish they dislike without anyone stopping them — absolutely chaotic! 🍽️ This vulnerability means anyone can play chef with your site's content. This vulnerability stems from a missing authorization check in the 'delete_object' function of the Frontend Admin plugin, affecting all versions up to and including 3.28.25, allowing unauthorized modifications and deletions of data.
An attacker could stroll in and delete critical components of your site, leading to loss of content, broken links, and potentially shutting down your business. Picture waking up to an empty menu after someone cleared it out overnight — devastating! Immediately patch to version 3.28.26 or higher to close off this critical vulnerability. Also, review and strengthen your user access controls to ensure only authorized personnel can modify or delete content. 🛡️ You've got this! Follow these steps to secure your site and reclaim your content! 🚀