What’s Vulnerable › Vulnerabilities
CVE-2026-103693: Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
- Severity: critical (CVSS 9.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-29 · updated 2026-10-29
- Weakness: CWE-502
Description
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
Summary
Frontend Dashboard before 3.0.5 and ProfileGrid before 6.0.0.5 allow an unauthenticated user to store a serialized PHP object in user metadata, which is deserialized when a public profile is viewed. This PHP object injection can lead to arbitrary file write and potential remote code execution, with a critical CVSS score of 9. There is no evidence of exploitation and it is not in CISA KEV. Update Frontend Dashboard to 3.0.5 and ProfileGrid to 6.0.0.5.
تسمح إضافتا Frontend Dashboard قبل الإصدار 3.0.5 وProfileGrid قبل الإصدار 6.0.0.5 لمستخدم غير مصادق عليه بتخزين كائن PHP متسلسل في بيانات المستخدم الوصفية، ويُفكّ تسلسله عند عرض الملف الشخصي العام. قد يؤدي هذا الحقن إلى كتابة ملفات عشوائية واحتمال تنفيذ تعليمات برمجية عن بُعد، بدرجة خطورة حرجة 9 وفق CVSS. لا توجد أدلة على استغلاله ولم يُدرج في CISA KEV. حدّثا Frontend Dashboard إلى 3.0.5 وProfileGrid إلى 6.0.0.5.
Affected products
- Frontend Dashboard: before 3.0.5 — fixed in 3.0.5
- metagauss ProfileGrid – User Profiles, Groups and Communities: before 6.0.0.5 — fixed in 6.0.0.5
How to fix
Upgrade to a fixed version: Frontend Dashboard 3.0.5; metagauss ProfileGrid – User Profiles, Groups and Communities 6.0.0.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103693 or the next vulnerability affects your stack