CVE-2026-103692— Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
Quick assessment
Affected
Unknown Frontend Dashboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frontend Dashboard WordPress 插件在 3.0.5 版本之前，对于未认证用户可执行的操作未进行任何授权检查或非ce（nonce）验证。这些操作允许攻击者通过请求数据调用其指定的 PHP 函数或类方法，从而导致未认证用户可以接管任意账户，包括管理员账户。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103692
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
Source: CVE Program / CVE List V5
Vulnerability Description
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Frontend Dashboard | 3.0.0 ~ 3.0.5 | - |
|
II. Public POCs for CVE-2026-103692
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103692
请登录查看更多情报信息。
Other References for CVE-2026-103692 (1)
-
https://wpscan.com/vulnerability/d2341538-77fa-48a0-83e3-bc9a3818276c/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-08 · 24 CVEs total
| CVE-2026-93509 | 6.5 MEDIUM | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via |
| CVE-2026-103517 | 5.3 MEDIUM | Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Web |
| CVE-2026-104671 | 5.3 MEDIUM | TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX |
| CVE-2026-105190 | 5.3 MEDIUM | Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabl |
| CVE-2026-103309 | GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage | |
| CVE-2026-103646 | Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Pa | |
| CVE-2026-104646 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortc | |
| CVE-2026-104645 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Im | |
| CVE-2026-105195 | Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure | |
| CVE-2026-105197 | LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR | |
| CVE-2026-105198 | LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR | |
| CVE-2026-105194 | Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Dow | |
| CVE-2026-105196 | LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API | |
| CVE-2026-105193 | Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification | |
| CVE-2026-86826 | BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory | |
| CVE-2026-86827 | BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php | |
| CVE-2026-86828 | BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback | |
| CVE-2026-105260 | Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF | |
| CVE-2026-94246 | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Reques | |
| CVE-2026-94244 | Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosu |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Frontend Dashboard
-
CVE-2026-103681
Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Fi -
CVE-2025-49310
WordPress Frontend Dashboard plugin <= 2.2.8 - Cross Site Sc -
CVE-2025-4474
Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Au -
CVE-2025-4473
Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to -
CVE-2025-4104
Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Un
Same vendor: Unknown
-
CVE-2026-105190
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Cre -
CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ W -
CVE-2026-103517
Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated -
CVE-2026-104671
TutorStarter < 4.0.4 - Unauthenticated User Registration Byp -
CVE-2026-94245
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ A
V. Comments for CVE-2026-103692
No comments yet