Privilege Escalation Vulnerability in Frontend Dashboard Plugin for WordPress

CVE-2025-4104

What is CVE-2025-4104?

The Frontend Dashboard plugin for WordPress contains a vulnerability that allows unauthenticated users to escalate their privileges. The issue arises from a missing capability check in the fed_wp_ajax_fed_login_form_post() function, enabling attackers to modify the administrator's email and password. This flaw affects versions 1.0 through 2.2.6, posing a significant risk as it permits unauthorized access to sensitive administrative functions.

References