{"id":"CVE-2026-103693","kind":"vulnerability","aliases":["CVE-2026-103693"],"related":[],"title":"WordPress Frontend Dashboard and ProfileGrid: object injection allows file write and code execution","description":"The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid  WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.","summary":"The Frontend Dashboard and ProfileGrid WordPress plugins let an unauthenticated user store a serialized PHP object in user metadata. The object is deserialized when a public profile is viewed, which can lead to arbitrary file writes and potentially remote code execution.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend-dashboard","package","php","profilegrid","self-hosted","wordpress"],"not_affected_if":["no-public-profiles","plugin-at-fixed-version","plugin-not-installed"],"how_to_check":"- Check whether the Frontend Dashboard plugin is installed and its version is below `3.0.5`.\n- Check whether the ProfileGrid plugin is installed and its version is below `6.0.0.5`.\n- Review the plugin list in the WordPress admin under Plugins.","fix":"- Frontend Dashboard: update to `3.0.5` or later.\n- ProfileGrid: update to `6.0.0.5` or later.","status":"open","published_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:12+00:00","triaged_at":"2026-10-29T06:54:59+00:00","updated_at":"2026-10-29T06:54:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T06:54:59Z","model":"claude-haiku-5-5","output":{"fix":"- Frontend Dashboard: update to `3.0.5` or later.\n- ProfileGrid: update to `6.0.0.5` or later.","reach":"internet","title":"WordPress Frontend Dashboard and ProfileGrid: object injection allows file write and code execution","impact":"high","summary":"The Frontend Dashboard and ProfileGrid WordPress plugins let an unauthenticated user store a serialized PHP object in user metadata. The object is deserialized when a public profile is viewed, which can lead to arbitrary file writes and potentially remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted","frontend-dashboard","profilegrid"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the web server, files written to disk","analyst_note":"Confirm the exact affected version ranges and whether a public proof of concept exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-103693.","how_to_check":"- Check whether the Frontend Dashboard plugin is installed and its version is below `3.0.5`.\n- Check whether the ProfileGrid plugin is installed and its version is below `6.0.0.5`.\n- Review the plugin list in the WordPress admin under Plugins.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-at-fixed-version","no-public-profiles"],"who_is_affected":"Sites running the Frontend Dashboard plugin before 3.0.5 or the ProfileGrid plugin before 6.0.0.5 that show public user profiles. The flaw is reached through user metadata that anyone can write, so sites with public profile pages are the main exposure. Sites without either plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4161,"output_tokens":679,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103693':16A,19A '-2026':15A,18A '3.0.5':77C '6.0.0.5':82C 'allow':8A,107C 'arbitrari':63B,115C 'code':12A,69B,121C 'cve':14A,17A 'dashboard':3A,22B,32B,73C 'deseri':52B,100C 'execut':13A,70B,122C 'file':9A,64B,116C 'frontend':2A,21B,31B,72C 'frontend-dashboard':20B 'host':28B 'inject':7A,110C 'lead':61B,113C 'let':37B 'metadata':48B,97C 'object':6A,45B,50B,94C,109C 'packag':23B 'php':24B,44B,93C,108C 'plugin':36B,75C,80C 'potenti':67B,119C 'prevent':85C 'profil':56B,104C 'profilegrid':5A,25B,34B,78C 'public':55B,103C 'remot':68B,120C 'self':27B 'self-host':26B 'serial':43B,92C 'store':41B,90C 'unauthent':39B,87C 'user':40B,47B,88C,96C 'view':58B,106C 'wordpress':1A,29B,35B,74C,79C 'write':10A,65B,117C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Frontend Dashboard plugin before 3.0.5 or the ProfileGrid plugin before 6.0.0.5 that show public user profiles. The flaw is reached through user metadata that anyone can write, so sites with public profile pages are the main exposure. Sites without either plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103693","severity":null,"published_at":"2026-10-29T06:17:17+00:00","modified_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:12+00:00","fetched_at":"2026-10-29T06:53:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}