CVE-2025-4104: Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fedwpajaxfedloginformpost() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4104?
CVE-2025-4104 is classified as a critical vulnerability due to its potential to allow unauthenticated attackers to escalate privileges.
How do I fix CVE-2025-4104?
To fix CVE-2025-4104, update the Frontend Dashboard plugin to version 2.2.7 or later, where the vulnerability has been patched.
What versions of Frontend Dashboard are affected by CVE-2025-4104?
CVE-2025-4104 affects all versions of the Frontend Dashboard plugin from 1.0 to 2.2.6.
What type of attack does CVE-2025-4104 enable?
CVE-2025-4104 enables unauthenticated attackers to reset the administrator's email, leading to potential account takeover.
Is my website vulnerable if I use Frontend Dashboard prior to version 2.2.7?
Yes, if you are using any version of Frontend Dashboard prior to 2.2.7, your website is vulnerable to CVE-2025-4104.