Unauthenticated Membership Plan Deletion in Frontend Admin WordPress Plugin

Executive Summary

This vulnerability is in the Frontend Admin by DynamiApps WordPress plugin before version 3.29.11. It lacks a capability check on an AJAX action, allowing any authenticated user, including low-privilege users like subscribers, to delete arbitrary membership plans.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Frontend Admin by DynamiApps plugin. If it is below 3.29.11, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete membership plans, potentially disrupting services or causing data loss. Since subscribers can perform this action, it increases the risk of unauthorized deletions by low-privilege users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion, violating integrity and availability principles in GDPR and HIPAA. It may result in non-compliance due to lack of access control, potentially leading to fines or penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Frontend Admin by DynamiApps plugin to version 3.29.11 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent unauthorized membership plan deletions.

Useful 0 Not Useful 0