CVE-2026-103692: Unknown Frontend Dashboard

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

Affected products

• Unknown Frontend Dashboard: from 3.0.0, before 3.0.5 (fixed in 3.0.5)

Published 2026-10-08. Last modified 2026-10-08.