Can you explain this vulnerability to me?

The Frontend Admin by DynamiApps plugin for WordPress has a vulnerability that allows unauthenticated attackers to escalate their privileges. This happens because the plugin insecurely handles form submissions by accepting arbitrary form definitions from user input instead of securely loading them from the backend.

Specifically, when the form data ($_POST['_acf_form']) is an array rather than a form ID, the validate_form() function skips the usual database lookup and processes the attacker-controlled form structure directly. The create_record() function then preserves attacker-supplied record data, and the user action's run() function uses attacker-controlled field definitions if legitimate fields are missing.

Because the role field's validation reads role options from this attacker-controlled data, an attacker can specify 'administrator' as an allowed role, bypassing security checks and creating administrator accounts without authentication.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can have severe impacts as it allows unauthenticated attackers to create administrator accounts on a WordPress site using the vulnerable plugin.

• Attackers gain full administrative control over the affected WordPress site.
• They can modify site content, install malicious plugins or themes, and access sensitive data.
• The integrity, confidentiality, and availability of the website and its data can be compromised.
• It can lead to further exploitation, data breaches, or site defacement.

Useful 0 Not Useful 0