Privilege Escalation in Frontend Dashboard for WordPress

CVE-2025-4473

What is CVE-2025-4473?

The Frontend Dashboard plugin for WordPress contains a vulnerability that allows authenticated users, with Subscriber-level access or higher, to exploit a missing capability check in the ajax_request() function. This oversight enables attackers to reroute outgoing emails by setting the SMTP server to their own, thereby capturing sensitive emails like password reset notifications meant for administrators. This could ultimately give malicious actors the ability to elevate their privileges and potentially take complete control of the site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References