Description
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
References (6)
Core 6
Core References
Scores
CVSS v3
9.8
EPSS
0.0048
EPSS Percentile
37.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-285
Status
published
Products (1)
vinoth06/Frontend Dashboard
1.0 - 2.2.6
Published
May 07, 2025
Tracked Since
Feb 18, 2026