PT-2025-20067 · WordPress · Frontend Dashboard

Kenneth Dunn · Published 2025-05-07 · Updated 2025-05-12 · CVE-2025-4104

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend Dashboard plugin for WordPress versions 1.0 through 2.2.6

Description The Frontend Dashboard plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the fed wp ajax fed login form post() function. This allows unauthenticated attackers to reset the administrator's email and password, and elevate their privileges to that of an administrator.

Recommendations For versions 1.0 through 2.2.6, consider disabling the fed wp ajax fed login form post() function until a patch is available to prevent exploitation. Restrict access to the administrator's account and monitor for any suspicious activity. Update to a version that includes a fix for this issue as soon as it becomes available.

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-4104

Affected Products

Frontend Dashboard

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-4104 · Security Note
• https://t.me/cvetracker/23259 · Telegram Post
• https://twitter.com/cracbot/status/1921883146536014122 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/31e518a9-316b-40a4-ada7-317fb2c16766?source=cve · Note
• https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/register.php#L16 · Note
• https://twitter.com/cybercronai/status/1920135424858558949 · Twitter Post
• https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.6/includes/frontend/request/login/index.php#L21 · Note
• https://twitter.com/cybercronai/status/1920142958956814420 · Twitter Post
• https://twitter.com/cybercronai/status/1920135421947683192 · Twitter Post
• https://t.me/cvenotify/121174 · Telegram Post
• https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/frontend/request/login/validation.php · Note
• https://plugins.trac.wordpress.org/changeset/3288562 · Note
• https://twitter.com/CVEnew/status/1920054121518031327 · Twitter Post
• https://wordpress.org/plugins/frontend-dashboard/#developers · Note
• https://t.me/cvedetector/24709 · Telegram Post