Critical · published May 7, 2025
🚨 Unauthenticated attackers can reset admin credentials with this WordPress plugin flaw! 🔥 Think of it like an uninvited guest at a party who finds a way to sneak past the bouncer and start giving out the admin's keys — not cool! This vulnerability allows someone without any credentials to reset the administrator’s email and password, taking full control of the site—imagine the chaos if a mischievous intruder starts deleting content or manipulating settings! Your entire website could be at risk, leading to devastating consequences for your business.
Think of it like an uninvited guest at a party who finds a way to sneak past the bouncer and start giving out the admin's keys — not cool! The Frontend Dashboard plugin for WordPress lacks a crucial capability check in the fed_wp_ajax_fed_login_form_post() function. This means any user can escalate their privileges to administrator level, bypassing authentication altogether.
This vulnerability allows someone without any credentials to reset the administrator’s email and password, taking full control of the site—imagine the chaos if a mischievous intruder starts deleting content or manipulating settings! Your entire website could be at risk, leading to devastating consequences for your business. Immediately update the Frontend Dashboard plugin to version 2.2.7 or higher to patch this vulnerability. Additionally, audit your user roles and permissions to ensure no unauthorized access has occurred. Don't forget to regularly check for plugin updates! You've got this! By staying proactive, you'll safeguard your site and keep those pesky intruders at bay. 🛡️