Privilege Escalation in Frontend Dashboard for WordPress

CVE-2025-4473

What is CVE-2025-4473?

The Frontend Dashboard plugin for WordPress contains a vulnerability that allows authenticated users, with Subscriber-level access or higher, to exploit a missing capability check in the ajax_request() function. This oversight enables attackers to reroute outgoing emails by setting the SMTP server to their own, thereby capturing sensitive emails like password reset notifications meant for administrators. This could ultimately give malicious actors the ability to elevate their privileges and potentially take complete control of the site.

References