Frontend Dashboard and ProfileGrid WordPress plugins: PHP object injection
Summary
Frontend Dashboard before 3.0.5 and ProfileGrid before 6.0.0.5, two WordPress plugins, do not prevent unauthenticated users from storing a serialized PHP object in user metadata. The object is deserialized when a public profile is viewed. An attacker could thereby achieve arbitrary file write and potentially remote code execution, depending on other code on the site. The flaw is a high-priority concern for public WordPress sites that use these plugins.
Affected
- Frontend Dashboard before 3.0.5
- ProfileGrid before 6.0.0.5
Fixed in
- Frontend Dashboard 3.0.5
- ProfileGrid 6.0.0.5
Workaround
Unknown. No vendor workaround found. As a temporary option, restrict or disable public profile pages until the update is installed.
Exploitation
- No public exploit code found.
- Not listed in CISA KEV; no exploitation reported as of the sources' cut-off date.
- VulDB describes exploitation as easy; this is an assessment, not evidence of attacks.
Our recommendation
- Inventory WordPress sites for Frontend Dashboard below 3.0.5 and ProfileGrid below 6.0.0.5.
- Update to the fixed versions and verify the installed versions afterwards.
- Review user profile metadata for unusual serialized values and check for unexpected files, admin accounts or PHP changes; this is not a complete detection method.
- Watch for the NVD analysis, a CISA KEV entry or a public PoC, which would raise priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record CVE-2026-103693 wpscan.com
- VulDB CVE-2026-103693 vuldb.com
- VulDB vulnerability 428318 vuldb.com
- OffSeq Radar CVE-2026-103693 radar.offseq.com
- Strix CVE-2026-103693 www.strix.ai
- ThreatINT CVE-2026-103693 cve.threatint.com
- WordPress.org Frontend Dashboard plugin tag page wordpress.org
- WPScan ProfileGrid plugin page wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:01.
Original description (NVD)
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.