Live › vulnerability › CVE-2026-103693
The Frontend Dashboard and ProfileGrid WordPress plugins let an unauthenticated user store a serialized PHP object in user metadata. The object is deserialized when a public profile is viewed, which can lead to arbitrary file writes and potentially remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Frontend Dashboard plugin before 3.0.5 or the ProfileGrid plugin before 6.0.0.5 that show public user profiles. The flaw is reached through user metadata that anyone can write, so sites with public profile pages are the main exposure. Sites without either plugin can skip it.
No product ranges from the sources yet.
3.0.5.6.0.0.5.3.0.5 or later.6.0.0.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-103693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.