Unscored severity · published Oct 29, 2026
CVE-2026-103693
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
New
–
CVSS
–
EPSS
No
On KEV
Description
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FD
Frontend Dashboard ·
before 3.0.5 · source: vendor
PR
ProfileGrid ·
before 6.0.0.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103693
exploit
https://wpscan.com/vulnerability/c156065f-76f1-4f44-bc57-b7d57560813f/
More from Frontend Dashboard
9.8
CVE-2026-103692
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
4.3
CVE-2026-103681
Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete