Frontend Dashboard: Unauthenticated privilege escalation via arbitrary function call
Summary
The Frontend Dashboard WordPress plugin before version 3.0.5 performs no authorisation or nonce check on actions available to unauthenticated users. Such requests can call an attacker-chosen PHP function or class method with request data. An unauthenticated remote attacker can therefore take over any account, including administrator accounts, which can lead to full compromise of the WordPress site. No login is required, so any internet-facing site running an affected version is exposed.
Affected
- Frontend Dashboard WordPress plugin, versions 3.0.0 to before 3.0.5 (per WPScan and the CVE record)
- Other trackers list affected versions as 'before 3.0.5' without a lower bound
Fixed in
- Version 3.0.5 (named as the fix by WPScan)
- Verify against the vendor's current release, because a separate CVE (CVE-2026-107424) reports a privilege-escalation issue in this plugin up to version 3.0.7
Workaround
- No vendor workaround known.
- A third-party suggestion is to restrict WordPress admin paths by IP allowlist; this does not cover plugin endpoints on public pages and is therefore a weak control.
Exploitation
- One tracker reports that no public exploit is available; this is not independently verified.
- Exploitation in the wild: Unknown. No CISA KEV listing found.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Inventory WordPress sites for Frontend Dashboard and note the installed versions.
- Update to the latest available release, not only 3.0.5.
- If no update is possible, deactivate and remove the plugin on internet-facing sites.
- Review administrator accounts and recent password resets on any site that ran an affected version.
- Check ProfileGrid as well, if installed (related CVE-2026-103693 affects it).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- VulDB CVE-2026-103692 vuldb.com
- VulDB 415270 vuldb.com
- Rapid7 via Vulners CVE-2026-103692 vulners.com
- VulDB 419815 (related CVE-2026-107424) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:34.
Original description (NVD)
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.