CVE-2026-6228: Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the adminform post type. The adminform custom post type uses 'capabilitytype' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edituser form, they can manipulate the form configuration to include 'administrator' in the roleoptions array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmingetuserroles(). When the form is subsequently submitted, the preupdatevalue() function in class-role.php only validates that the submitted role exists in the form's roleoptions array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public newuser form), then create an edituser form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrator.