CVE-2026-103692

CriticalCVSS 9.8

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

Risk Assessment

An attacker could take over an administrator account, leading to full control of the WordPress site, including content modification, malware installation, or data theft.

Recommendation

Update the Frontend Dashboard plugin to version 3.0.5 or later, which includes security fixes.

Other vulnerabilities in Frontend Dashboard

CVE-2026-107424Critical
An incorrect privilege assignment vulnerability exists in the M A Vinoth Kumar Frontend Dashboard plugin, allowing privilege escalation. This enables users to gain higher privileges than intended.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS