Frontend Dashboard CVE-2026-103681

Exploitation requires an authenticated WordPress account with at least subscriber-level (low) privileges on a site running Frontend Dashboard before 3.0.0, meaning the site must allow low-privilege user registration or the attacker must already hold a low-tier account. The vulnerable AJAX action is reachable without special configuration, and no user interaction or elevated privileges are needed beyond the subscriber role. The key limiting factors are: (1) a valid low-privilege authenticated session is mandatory (PR:L), and (2) impact is confined to deleting the plugin's configured profile and post form fields (integrity only) - no data disclosure or full site takeover.

This is a moderate-severity broken access control flaw (CWE-284) with a low real-world priority. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) shows a network-reachable, low-complexity issue but one that REQUIRES an authenticated account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. These low-impact signals are corroborated by the CISA SSVC decision framework: Exploitation=none, Automatable=no, Technical Impact=partial - i.e. no observed exploitation and no reliable mass-automation path. Publicly available exploit code exists (WPScan), which modestly raises opportunistic risk, but POC availability is NOT active exploitation and the CVE is NOT in CISA KEV. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. Net: this is a genuine but low-priority authorization bug - meaningful only on sites that allow low-privilege user registration and that run the vulnerable plugin, and it should be patched during normal maintenance rather than treated as an emergency.

On a WordPress site running Frontend Dashboard before 3.0.0 that permits self-registration, an attacker registers (or logs in with) a low-privilege subscriber account and sends a crafted request to the vulnerable AJAX action. Because the action omits a capability check, the request succeeds and deletes the plugin's configured profile and post form fields, disrupting the site's front-end forms. A public proof-of-concept is documented by WPScan.