CVE-2026-103693
CVE-2026-103693 · Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
CVSS 9.0 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
frontend dashboard
- Versions
- ≥ 0, < 3.0.5: Affected (semver)
Update to 3.0.5
profilegrid
- Versions
- ≥ 0, < 6.0.0.5: Affected (semver)
Update to 6.0.0.5