Improper Access Control in Frontend Dashboard Plugin for WordPress
CVE-2026-103681

Currently unrated

Key Information:

Vendor

WordPress
Status
Frontend Dashboard
Vendor
CVE Published:
7 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-103681?

The Frontend Dashboard plugin for WordPress prior to version 3.0.0 is susceptible to improper access control due to its failure to enforce capability checks during AJAX actions. This oversight permits authenticated users with lower privileges, such as subscribers, to delete crucial settings associated with the plugin's profile and post form fields. This vulnerability could lead to unauthorized modifications and disrupt the intended functionality of the site.

Affected Version(s)

Frontend Dashboard 0 < 3.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-103681 - Proof of Concept

References

https://wpscan.com/vulnerability/33674814-6329-4833-8d9a-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Dhaniswara
WPScan
.