EUVD-2026-101013
GHSA-grrc-h2jw-4w99
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach vulnerable plugin endpoint
-
ExploitSubmit crafted privilege/role parameter
-
ExecutionIncorrect privilege assignment grants admin role
-
ImpactFull site takeover and content/data control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires network access to a WordPress site with the Frontend Dashboard plugin (M A Vinoth Kumar) installed at version 3.0.7 or earlier, reaching the plugin's frontend account/role-management functionality. The supplied CVSS vector states no privileges and no user interaction (PR:N/UI:N), implying exploitation against a default install; however, as a CWE-266 privilege-escalation flaw, exploitation in practice most likely requires an existing low-privileged account (such as subscriber) to elevate from, which in turn typically requires that open user registration be enabled - this limiting condition should be confirmed against the Patchstack advisory. Exploitation is bounded to sites actually running this plugin within the affected version range. |
| Impact | The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on its face indicates a remote, unauthenticated, low-complexity privilege-escalation flaw with full confidentiality, integrity, and availability impact - a theoretically maximal-severity issue. However, these signals should be weighed critically. There is NO EPSS score, NO CISA KEV listing, and NO public POC indicated in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The PR:N metric is also in tension with the vulnerability class: CWE-266 (Incorrect Privilege Assignment) privilege-escalation bugs in WordPress plugins typically require an already-authenticated low-privileged account (e.g., subscriber) to escalate FROM - Patchstack-sourced 'privilege escalation' entries are frequently scored PR:N by the vendor even when a registered account is a practical prerequisite. This should be verified against the Patchstack advisory. Net: this is a serious, high-impact flaw worth prompt patching for anyone running the plugin, but in the absence of EPSS/KEV/POC evidence it is a high-CVSS issue without confirmed real-world exploitation, and the unauthenticated designation is uncertain. |
| Exploit ScenarioDerived | An attacker who can register or already holds a low-privileged account on a WordPress site running Frontend Dashboard (≤ 3.0.7) sends crafted requests to the plugin's account/profile-management functionality to assign themselves a higher role (e.g., administrator). No public exploit code was identified at the time of analysis. Given AV:N/AC:L, the request-level interaction is simple once the attacker can reach the vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
RemediationAI
No vendor-released patch identified at time of analysis, and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/frontend-dashboard/vulnerability/wordpress-frontend-dashboard-plugin-3-0-7-privilege-escalation-vulnerability?_s_id=cve) should be monitored for a fixed version. Until a patch ships, the highest-value compensating control is to deactivate and delete the Frontend Dashboard plugin if front-end account/role management is not essential; this removes the vulnerable code path entirely at the cost of the front-end dashboard features. If the plugin must remain active, disable the plugin's role/account-management functionality where it can be turned off in settings, and disable open user registration (WordPress Settings → General → Membership) so no low-privileged subscriber accounts exist to elevate from - the trade-off is that legitimate self-registration is blocked. Additionally, restrict access to the plugin's front-end endpoints to trusted IP ranges or authenticated users via WAF/reverse-proxy rules (can break legitimate user workflows if overly broad), and, as detection and containment, audit wp_users/wp_usermeta for unexpected administrator accounts and enable logging of role changes to catch exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin, Frontend Dashboard, that provides front-end account, profile and role-management functionality for logged-in users. CWE-266 (Incorrect Privilege Assignment) describes the root-cause class: the plugin fails to properly validate the privileges of the acting user, or mis-assigns roles/capabilities, before performing a role or capability change, so that a lower-privileged user can grant themselves higher privileges. In WordPress this normally manifests where a request handler omits or misapplies checks such as current_user_can('promote_users')/current_user_can('edit_users') or nonce verification, exposing the role-assignment path to unauthorized callers. The CPE entry cpe:2.3:a:m_a_vinoth_kumar:frontend_dashboard:*:*:*:*:*:*:*:* confirms the whole plugin is in scope, with the vendor advisory noting versions up to and including 3.0.7. The exact request path and role-assignment endpoint should be confirmed against the Patchstack advisory, but the impact class is a vertical privilege escalation (subscriber-to-administrator or similar) on WordPress sites with the plugin installed.
Know when Frontend Dashboard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Privilege escalation requires an account to escalate from, so PR:L rather than PR:N; successful elevation to administrator yields full C/I/A impact over the site.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.
Articles & Coverage 1
Executive ViewAI
WordPress sites running the Frontend Dashboard plugin (versions through 3.0.7) are exposed to a critical privilege-escalation flaw that could let an attacker with even a basic subscriber-level account gain elevated capabilities over the site. Because no vendor patch is currently available, any affected site with open user registration is a potential path to content tampering, data exposure, or full site takeover - a direct risk to brand integrity and customer trust. Leadership should treat this as an inventory-and-remediation problem: the exposure is limited to sites actually running this plugin, so rapid identification and removal of the plugin eliminates the risk.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Frontend Dashboard plugin; disable open user registration and self-service account creation; restrict and audit elevated roles; deploy WAF/virtual-patching rules targeting privilege and role-change requests; and monitor for unauthorized account or capability changes. Note: the vendor CVSS vector reports PR:N (no privileges required), while the assessed vector is PR:L, indicating exploitation in practice most likely requires an existing low-privileged account to elevate from. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Frontend Dashboard
View allThe Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering o
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured pro
Exploit-DB