CVE-2025-4474: Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fedadminsettingformfunction() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4474?
CVE-2025-4474 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2025-4474?
To fix CVE-2025-4474, update the Frontend Dashboard plugin to version 2.2.8 or later.
Who is affected by CVE-2025-4474?
CVE-2025-4474 affects authenticated users with Subscriber-level access and above.
What does CVE-2025-4474 exploit?
CVE-2025-4474 exploits a missing capability check in the fed_admin_setting_form_function().
Which versions of the Frontend Dashboard plugin are vulnerable to CVE-2025-4474?
Versions 1.0 to 2.2.7 of the Frontend Dashboard plugin are vulnerable to CVE-2025-4474.