Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-103692

Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 3.0.5
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

Affected versions

  • Unknown Frontend Dashboard

    From 3.0.0 · fixed in 3.0.5

References 1

wpscan.com