CVE-2025-13342: 
WordPress vulnerability analysis and mitigation

CVE-2025-13342 is an unauthorized WordPress options modification vulnerability in the Frontend Admin by DynamiApps plugin, affecting all versions up to and including 3.28.20. Due to insufficient capability checks and input validation in the ActionOptions::run() save handler, unauthenticated attackers can modify critical WordPress options — including users_can_register, default_role, and admin_email — by submitting crafted form data to public frontend forms. The vulnerability was published on December 3, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization): the ActionOptions::run() save handler in the plugin processes form submissions from public-facing frontend forms without verifying whether the submitting user has the necessary WordPress capabilities. Combined with insufficient input validation, this allows any unauthenticated network attacker to supply arbitrary WordPress option names and values via crafted POST data. The attack vector is network-based, requires no privileges or user interaction, and exploits the plugin's design of exposing option-saving functionality through publicly accessible forms (Wordfence, Red Hat CVE).

Successful exploitation allows unauthenticated attackers to modify any WordPress site option, enabling a range of high-impact outcomes: enabling open user registration (users_can_register=1), setting the default role to Administrator (default_role=administrator), and hijacking the admin email (admin_email) to intercept password reset links. These changes can lead to complete site takeover — attackers can register themselves as administrators, lock out legitimate owners, and compromise the confidentiality, integrity, and availability of the entire WordPress installation (Wordfence).

A public proof-of-concept exploit is available on GitHub (PoC GitHub), added on March 2, 2026, with a second PoC also published (PoC GitHub 2). As of the available intelligence, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.04% (low probability of near-term exploitation), and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Frontend Admin by DynamiApps plugin (version ≤ 3.28.20) via tools like WPScan, Shodan, or by inspecting page source for plugin-specific assets (e.g., /wp-content/plugins/acf-frontend-form-element/).
2. Locate public frontend forms: Browse the target site for pages rendering Frontend Admin forms, which are publicly accessible without authentication.
3. Craft malicious POST request: Intercept a legitimate form submission (e.g., using Burp Suite) or construct a direct HTTP POST request targeting the form's action endpoint, injecting WordPress option fields such as users_can_register=1, default_role=administrator, and admin_email=attacker@evil.com.
4. Submit crafted form data: Send the crafted POST request to the WordPress site. The ActionOptions::run() handler processes the request without capability checks, writing the attacker-supplied values directly to the WordPress options table.
5. Register as administrator: With users_can_register=1 and default_role=administrator set, navigate to the site's registration page (/wp-login.php?action=register) and create a new account, which is automatically granted administrator privileges.
6. Full site takeover: Log in with the newly created administrator account to gain complete control of the WordPress installation (PoC GitHub, Wordfence).

• Network: Unexpected HTTP POST requests to WordPress frontend form endpoints containing WordPress option field names (users_can_register, default_role, admin_email) from unauthenticated sessions; unusual POST traffic to pages hosting Frontend Admin forms.
• Logs: WordPress debug or access logs showing form submissions with option-modifying parameters from anonymous/unauthenticated users; sudden changes recorded in the wp_options table for users_can_register, default_role, or admin_email.
• WordPress Database: wp_options table entries for users_can_register set to 1, default_role changed to administrator, or admin_email changed to an unrecognized address.
• User Accounts: Newly created WordPress administrator accounts with no prior activity or unfamiliar email addresses, especially created shortly after suspicious form submissions.
• File System: Presence of plugin version ≤ 3.28.20 at /wp-content/plugins/acf-frontend-form-element/ (Wordfence).

The primary remediation is to update the Frontend Admin by DynamiApps plugin to a version beyond 3.28.20 that addresses the capability check deficiency; the patch changeset is available at the WordPress plugin repository (Plugin Changeset). If an immediate update is not possible, deactivate and remove the plugin from all WordPress installations. As interim measures, implement Web Application Firewall (WAF) rules to block unauthorized modifications to WordPress options via form submissions, monitor the wp_options table for unexpected changes to users_can_register, default_role, and admin_email, and audit existing user accounts for unauthorized administrator-level access (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which published the initial advisory on December 3, 2025. It was included in CISA's weekly vulnerability bulletin for the week of December 1, 2025, indicating broader government awareness. A PoC digest was highlighted in the security community blog "PoC Week" for December 15, 2025, and again in a year-end 2025 PoC roundup (CISA Bulletin, PoC Week).