CVE-2025-4104

Critical CVSS: 9.8

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.

Vendor

Product

CWE

CWE-285

Yayın Tarihi

2025-05-07 10:15:15

Güncelleme

2025-05-07 14:13:20

Source Identifier

security@wordfence.com

KEV Date Added

Kategoriler

CWE-285 CRITICAL 2025

Referanslar

https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/index.php#L21 https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/register.php#L16 https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/frontend/request/login/validation.php https://plugins.trac.wordpress.org/changeset/3288562/ https://wordpress.org/plugins/frontend-dashboard/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/31e518a9-316b-40a4-ada7-317fb2c16766?source=cve