{"id":"CVE-2026-103692","published":"2026-10-08T06:16:38.323","lastModified":"2026-10-08T20:51:18.123","description":"The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/d2341538-77fa-48a0-83e3-bc9a3818276c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated users to execute arbitrary PHP functions or class methods, leading to unauthorized access and potential account takeover, including admin accounts.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted request to an endpoint that calls an attacker-chosen PHP function or class method.","blast_radius":"If exploited, the impact is high, as it could result in full control over the affected WordPress site, including access to sensitive data and administrative functions.","remediation":"Upgrade to version 3.0.5 or later of the Frontend Dashboard WordPress plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:42:59.339Z"}}