logo_clicknbuy.png

CVE-2025-4473 – WordPress Frontend Dashboard Plugin Privilege Escalation Vulnerability

The following table lists the changes that have been made to the
CVE-2025-4473 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    May. 13, 2025

    Action Type Old Value New Value
    Added Description The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.
    Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-285
    Added Reference https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/function-admin.php#L3055
    Added Reference https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/layout/settings_tab/email/class-fed-email.php#L122
    Added Reference https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/route/class-fed-request.php#L35
    Added Reference https://plugins.trac.wordpress.org/changeset/3290623/
    Added Reference https://wordpress.org/plugins/frontend-dashboard/#developers
    Added Reference https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3a10b5-b024-4b3f-af67-b7fcb997d368?source=cve
Share the Post:

Related Posts