Frontend Dashboard
Monthly
PHP object injection in the Frontend Dashboard WordPress plugin before 3.0.5 and the ProfileGrid WordPress plugin before 6.0.0.5 allows unauthenticated visitors to store a serialized PHP object in user metadata, which is then deserialized when a public profile is viewed. The confirmed impact is arbitrary file write, with remote code execution described as potential and dependent on a usable POP gadget chain being reachable in the loaded code; the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.0) reflects the high attack complexity of that chain rather than any authentication barrier. No active exploitation is confirmed by the available sources (SSVC Exploitation: none), and a public PoC reference exists but is not verified as working exploit code.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured profile and post form fields in versions before 3.0.0 due to a missing capability check in an AJAX action. This broken access control flaw (CWE-284) has a CVSS score of 4.3 and publicly available exploit code, but no confirmed active exploitation. The risk is moderate because exploitation requires a low-privilege account and only affects data integrity, not confidentiality or availability.
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
PHP object injection in the Frontend Dashboard WordPress plugin before 3.0.5 and the ProfileGrid WordPress plugin before 6.0.0.5 allows unauthenticated visitors to store a serialized PHP object in user metadata, which is then deserialized when a public profile is viewed. The confirmed impact is arbitrary file write, with remote code execution described as potential and dependent on a usable POP gadget chain being reachable in the loaded code; the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.0) reflects the high attack complexity of that chain rather than any authentication barrier. No active exploitation is confirmed by the available sources (SSVC Exploitation: none), and a public PoC reference exists but is not verified as working exploit code.
Privilege escalation in the WordPress plugin Frontend Dashboard (M A Vinoth Kumar), affecting versions through 3.0.7, lets remote attackers obtain elevated account capabilities through incorrect privilege assignment (CWE-266). Patchstack scores the flaw 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L, meaning exploitation in practice most likely requires an existing low-privileged account (for example a subscriber) to elevate from, which typically presupposes that open user registration is enabled on the target site. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is bounded to WordPress sites actually running this plugin within the affected version range.
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured profile and post form fields in versions before 3.0.0 due to a missing capability check in an AJAX action. This broken access control flaw (CWE-284) has a CVSS score of 4.3 and publicly available exploit code, but no confirmed active exploitation. The risk is moderate because exploitation requires a low-privilege account and only affects data integrity, not confidentiality or availability.
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.