CVE-2026-103692: Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call

Q: Which installations are affected?

Frontend Dashboard versions 3.0.0 through 3.0.4 are affected. The issue is fixed in version 3.0.5.

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The vulnerable actions are available to unauthenticated users, and the missing authorization and nonce checks allow an attacker to invoke an attacker-chosen PHP function or class method using request data.

Q: What is the potential impact of successful exploitation?

An unauthenticated attacker can take over any account, including administrator accounts.

Published Oct 8, 2026

Updated

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

Affected Software

1 affected component

Frontend Dashboard Frontend Dashboard>=3.0.0<=3.0.4

Event History

Oct 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which installations are affected?

Frontend Dashboard versions 3.0.0 through 3.0.4 are affected. The issue is fixed in version 3.0.5.

Does exploitation require an authenticated WordPress account or user interaction?

No. The vulnerable actions are available to unauthenticated users, and the missing authorization and nonce checks allow an attacker to invoke an attacker-chosen PHP function or class method using request data.

What is the potential impact of successful exploitation?

An unauthenticated attacker can take over any account, including administrator accounts.

CVE-2026-103692: Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress account or user interaction?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress account or user interaction?

What is the potential impact of successful exploitation?