The frontend dashboard plugin suffers from an incorrect privilege assignment flaw that permits an attacker to elevate their privileges beyond the intended level. By exploiting this weakness, an adversary could gain administrative control over a WordPress site. The flaw is tied to CWE-266, which concerns improper authorization.

All installations of M A Vinoth Kumar’s Frontend Dashboard plugin from the earliest version up to and including 3.0.7 are vulnerable. The issue was fixed in version 3.0.8, so any deployment that has not yet upgraded remains at risk.

The vulnerability carries a CVSS score of 9.8, indicating an extremely high severity. The EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves sending payloads through the plugin’s interface or using authenticated sessions with limited privileges; however, no explicit prerequisites are detailed in the advisory. Consequently, the risk remains significant for sites that remain on vulnerable versions.