Vulnerability details

CVE-2026-103693

Frontend DashboardProfileGrid

Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection

CVSS 3.1

9.0Critical

Official description

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.

CVSS scores

Score	Version	Source	Vector
9.0Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	Frontend Dashboard	v < 3.0.5	CVEProject cvelistV5 (CNA)
—	ProfileGrid	v < 6.0.0.5	CVEProject cvelistV5 (CNA)

References and advisories

https://wpscan.com/vulnerability/c156065f-76f1-4f44-bc57-b7d57560813f/ exploitvdb-entrytechnical-description

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-29
Last updated: 2026-10-29
State: Published
Assigner (CNA): WPScan
Kolun priority: 34 · Low

Exploit prediction (EPSS)

0.47%

Probability of exploitation in 30 days

40.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-502
Deserialization of Untrusted Data