The vulnerability exists in the Frontend Dashboard WordPress plugin version below 3.0.5 and the ProfileGrid plugin version below 6.0.0.5, where an unauthenticated user can store a serialized PHP object in user metadata. When a public profile is viewed, this metadata is deserialized, allowing PHP Object Injection. This flow can lead to arbitrary file write and, consequently, remote code execution on the compromised WordPress installation.

The affected software includes the Frontend Dashboard plugin for WordPress versions less than 3.0.5 and the ProfileGrid plugin for WordPress versions less than 6.0.0.5. No specific vendor is listed; the impact applies to any WordPress site that has these plugins installed in the specified vulnerable versions.

Because the attack does not require authentication, the threat surface is broad. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the ability to execute arbitrary code signifies a high‑severity risk. The described exploit path relies on manipulating serialized PHP data in user metadata, which is then de‑serialized during public profile rendering. An attacker with malformed input can influence object states to overwrite files or execute code on the host. The lack of authentication requirement, combined with the potential for remote code execution, gives the vulnerability a high impact and a significant likelihood of exploitation in exposed WordPress environments.