Description

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/d2341538-77fa-48a0-83e3-bc9a3818276c/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-269

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T06:16:38.323Z

26 hours ago

Last modified

2026-10-08T20:51:18.123Z

12 hours ago