External risk intelligence

Frontend Dashboard and ProfileGrid WordPress Plugins PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-103693

The vulnerability affects WordPress plugins that manage public-facing user profiles. Since these plugins are designed to render content and user data directly to public web visitors, the vulnerable code path is inherently exposed to the internet as part of the normal operation of a public web application.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in widely used WordPress plugins that manage user profiles. The flaw allows an unauthorized individual to inject malicious code, which could then be executed on the server when a profile is accessed, potentially leading to unauthorized file modifications and remote code execution. The main concern is confirming relevance and exposure.

Unauthenticated code injection risk in user profile plugins.
Matters because public profile views trigger the vulnerability.
Confirm relevance and potential exposure to company systems.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending a specially crafted PHP object to a WordPress site that uses a vulnerable version of the affected plugin. This object, when stored in user metadata, can be triggered when a public profile is viewed. The deserialization of this object can lead to the execution of arbitrary code on the server.

Unauthenticated access to the website.
Viewing a public user profile.
Arbitrary file write and remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated user to write arbitrary files to the server and potentially execute code when a public user profile is viewed. This could affect the integrity of the web server and any data it stores.

Server files could be overwritten.
Exposure happens when viewing public profiles.
Arbitrary file write and code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability affecting the Frontend Dashboard and ProfileGrid WordPress plugins, platform or infrastructure teams should lead the response by first identifying all instances of these plugins across the environment. Confirming their exposure, business criticality, and identifying the specific application or site owners responsible for each instance is crucial for prioritizing remediation efforts. Planning the necessary updates or mitigations should then proceed based on this risk assessment.

Platform or infrastructure teams own this issue.
Verify plugin presence and public reachability first.
Coordinate with site owners for remediation planning.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are Frontend Dashboard and ProfileGrid plugins?

These are WordPress plugins used to manage and display user profiles on a website. They provide administrative interfaces for handling user data, often allowing site visitors to view profile pages. Because they manage how profile information is stored and rendered, they interact directly with the database and server-side processes whenever a profile is requested by a user.

What is PHP object injection in CVE-2026-103693?

This is a security weakness categorized as CWE-502. It occurs when a program takes untrusted input and converts it back into a complex data structure (deserialization) without sufficient checks. In this CVE, the plugins allow an attacker to inject a malicious serialized PHP object into user metadata. When the system later processes this data to display a profile, the object is deserialized, which can trick the server into executing unauthorized commands.

How is this vulnerability triggered?

The trigger involves two main steps: first, an attacker stores a crafted object in the user metadata via the plugin. Second, the vulnerability activates when a public profile associated with that data is viewed. Simply visiting the site does not trigger the bug; the specific code path that deserializes the metadata must be reached, which happens when the application renders the profile page for an observer.

Is my site at risk according to Halo Surface Signal?

Yes, if you use these plugins on a public-facing website, your risk is elevated. Halo Surface Signal notes that because these plugins are designed to render user data to web visitors, the vulnerable code path is inherently exposed to the internet. Any instance where public profiles are accessible by external users creates a direct path for the vulnerability to be triggered during normal operation.

How do I respond to this threat?

Start by identifying every WordPress instance in your environment where Frontend Dashboard or ProfileGrid are installed. Do not assume all installations are equally critical; coordinate with site owners to determine which sites are publicly reachable. Once you have a clear inventory, prioritize updating the plugins to the patched versions or disabling the affected profile features until you can safely apply the necessary updates.

References

wpscan.com/vulnerability/c156065f-76f1-4f44-bc57-b7d57560813f/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.