The Frontend Dashboard WordPress plugin versions 3.0.0 through 3.0.4 contains an authorization flaw. The plugin does not check that a user is authenticated or that the request includes a valid nonce before executing actions that allow a caller to specify an arbitrary PHP function or class method. The result is that an attacker who can send a crafted request to the plugin, even without authentication, can trigger the execution of chosen code and thereby take over any WordPress account, including administrators. This vulnerability is classified as elevation of privilege (CWE‑269).

Any WordPress site that has installed Frontend Dashboard plugin version earlier than 3.0.5 and has the plugin activated is vulnerable. The plugin itself is the only code component affected; other WordPress core files or plugins are not impacted by this issue.

The flaw scores 9.8 on the CVSS scale, indicating an extremely high risk to confidentiality, integrity, and availability of user accounts. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the vulnerability by sending a request that specifies a function name or method, but the exact details of the HTTP endpoint or required parameters are not disclosed in the CVE entry. Given the lack of authentication or nonce validation, exploitation is likely feasible as long as the vulnerable plugin is reachable. The risk is elevated for sites with publicly accessible dashboards and weak network defenses.