Frontend Dashboard: Subscriber AJAX action deletes configured fields
A low-privilege authenticated user, such as a Subscriber, can call an AJAX action without the required capability check and delete configured profile and post form fields. The action name and selection parameter are undisclosed; the description establishes configuration deletion, not arbitrary filesystem deletion. Affected versions: < 3.0.0. The authoritative export identifies 3.0.0 as fixed for this CVE.
- Component
- Frontend Dashboard
- Plugin slug
frontend-dashboard- Affected
- < 3.0.0
- Safe version
3.0.0- Published
- Oct 07, 2026
This CVE was published Oct 07, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update to 3.0.0 or a later supported release. Enforce the administrator capability before deleting field definitions, validate the target fields, and retain nonce protection against cross-site requests.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N