CVE-2026-103693: Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
Published Oct 29, 2026
·Updated
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
Affected Software
2 affected components
Frontend Dashboard WordPress plugin<3.0.5
ProfileGrid WordPress plugin<6.0.0.5
Event History
Oct 29, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Does an attacker need a WordPress account to exploit this issue?
No. The vulnerable plugins allow an unauthenticated user to store a serialized PHP object in user metadata.
2
What action triggers deserialization of the malicious data?
The stored object is deserialized when a public profile is viewed. Exploitation can lead to arbitrary file write and potentially remote code execution.