Frontend Dashboard and ProfileGrid: PHP Object Injection (CVE-2026-103693)
Frontend Dashboard and ProfileGrid WordPress plugins allow unauthenticated users to perform PHP object injection via user metadata, potentially leading to arbitrary file write and remote code execution.
CVE search metadata
CVE search record: CVE-2026-103693. Severity: critical. CVSS: 9.0. EPSS: 0.24%. KEV: no. Product: Frontend Dashboard (< 3.0.5), ProfileGrid (< 6.0.0.5). Brief: Frontend Dashboard and ProfileGrid: PHP Object Injection (CVE-2026-103693). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wordpress-plugin-rce/
Triage facts
Revision 1- Applicability
- Frontend Dashboard (< 3.0.5), ProfileGrid (< 6.0.0.5)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 15:39 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Frontend Dashboard (before 3.0.5) and ProfileGrid (before 6.0.0.5) WordPress plugins contain a vulnerability where unauthenticated users can store a serialized PHP object in user metadata. This object is deserialized when a public profile is viewed, enabling PHP object injection. This can lead to arbitrary file write and potential remote code execution.