CVE-2024-3729

The vulnerability results from improper handling of the missing PHP 'openssl' extension by the 'fea_encrypt' function. When the 'openssl' extension is not loaded on the server, an attacker can manipulate forms that process users and posts. This allows creating or editing accounts with administrator privileges, automatic login as any user (authentication bypass), and injecting arbitrary web scripts in post processing forms (XSS). A necessary condition for exploiting the vulnerability is the absence of the 'openssl' extension loaded in the PHP server configuration.

An unauthenticated attacker can gain full administrative access to the WordPress site (privilege escalation), log in as any user (authentication bypass), or inject and execute malicious web scripts (XSS) leading to further compromise of the service.

The Frontend Admin plugin by DynamiApps should be updated to a version higher than 3.19.4 according to the manufacturer's references. Additionally, it is recommended to ensure that the PHP 'openssl' extension is loaded on the server, which eliminates the necessary condition for exploiting this vulnerability.

Frontend Admin by DynamiApps plugin for WordPress, all versions up to and including 3.19.4, when the PHP 'openssl' extension is not loaded on the server.