CVE-2026-107424
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-266
Impact
Unauthenticated remote attackers can escalate privileges to take over the WordPress site without any prior credentials or user interaction.
Root cause
The plugin assigns user privileges incorrectly, allowing unauthorized privilege elevation.
Affected systems
Frontend Dashboard plugin through 3.0.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Frontend Dashboard to a version newer than 3.0.7 once available, or deactivate and remove the plugin immediately if no patch is out.
$ wp plugin deactivate frontend-dashboardAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7.