CVE-2025-4474: Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function
First published: Tue May 13 2025(Updated: )
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Frontend Dashboard | >=1.0<=2.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fb61159a-e501-4c55-a384-b6049e0f0bc8?source=cve
- https://wordpress.org/plugins/frontend-dashboard/#developers
- https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/request/admin.php#L26
- https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/request/tabs/login.php#L14
- https://plugins.trac.wordpress.org/changeset/3290623/
Frequently Asked Questions
What is the severity of CVE-2025-4474?
CVE-2025-4474 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2025-4474?
To fix CVE-2025-4474, update the Frontend Dashboard plugin to version 2.2.8 or later.
Who is affected by CVE-2025-4474?
CVE-2025-4474 affects authenticated users with Subscriber-level access and above.
What does CVE-2025-4474 exploit?
CVE-2025-4474 exploits a missing capability check in the fed_admin_setting_form_function().
Which versions of the Frontend Dashboard plugin are vulnerable to CVE-2025-4474?
Versions 1.0 to 2.2.7 of the Frontend Dashboard plugin are vulnerable to CVE-2025-4474.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/frontend dashboard
- canonical/frontend dashboard