CVE-2026-103692 Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
Unauthenticated attackers can escalate privileges and take over any account, including administrators, by calling arbitrary PHP functions in the Frontend Dashboard plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103692?
CVE-2026-103692 is a critical vulnerability in Unknown Frontend Dashboard, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
Weakness: CWE-269
Which versions are affected by CVE-2026-103692?
How do I fix CVE-2026-103692?
No fix has been published for CVE-2026-103692 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103692 being exploited?
There is no known exploitation of CVE-2026-103692 in the wild and no public exploit code.
Sources
Also known as GHSA-rcg2-h6jw-3mw9.