Frontend Dashboard CVE-2026-103693

Exploitation requires that the plugin's frontend user-registration/profile feature accept and persist attacker-supplied metadata from an unauthenticated user, and that the resulting public profile be viewable so the stored value is deserialized on view - both are default behaviors of these profile/membership plugins per the description. The confirmed impact is arbitrary file write; full remote code execution is described as 'potential', which for PHP object injection depends on a usable POP gadget chain being reachable in the loaded code - the available sources do not detail the exact trigger or which gadgets are required (consistent with the AC:H rating). Limiting factors: no authentication is needed (PR:N), but a public profile must actually be rendered to trigger deserialization, and reaching RCE rather than file write alone is not guaranteed by the sources.

This is a genuine high-priority issue, not an inflated CVSS score. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) indicates network-reachable, unauthenticated exploitation with total impact and a scope change, consistent with CWE-502 PHP object injection leading to arbitrary file write and potential RCE. The vuln.today decision label is act_now and a vendor patch is available, reinforcing urgency. However, the signals are not all aligned: CISA SSVC records Exploitation as 'none' and Automatable as 'no' (while Technical Impact is 'total'), and there is no KEV listing, so there is no evidence of active exploitation in the wild. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. The PoC is a reference only and is not verified as working exploit code. The AC:H metric signals non-trivial exploitation (object injection typically requires a usable POP gadget chain to reach RCE), but the available sources do not describe the trigger mechanism in detail, so the precise difficulty is unverified. Net: treat as a priority to patch promptly given unauthenticated reach, total technical impact, and the act_now label, while recognizing that automated mass exploitation is not currently indicated by SSVC.

An unauthenticated attacker uses the plugin's frontend registration/profile functionality to store a crafted serialized PHP object in their user metadata. When that user's public profile is subsequently viewed, the stored data is deserialized, triggering PHP object injection that can write arbitrary files and potentially achieve remote code execution on the host. A public PoC reference exists (WPScan); it is not verified as working exploit code, and the AC:H rating reflects that successful code execution depends on conditions not detailed in the available sources.