CVE-2026-103692

Summary

The flaw allows unauthenticated users to execute arbitrary PHP functions or class methods, leading to unauthorized access and potential account takeover, including admin accounts.

Exploitability

Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted request to an endpoint that calls an attacker-chosen PHP function or class method.

Blast radius

If exploited, the impact is high, as it could result in full control over the affected WordPress site, including access to sensitive data and administrative functions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.5 or later of the Frontend Dashboard WordPress plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.