CVE-2026-103693: PHP Object Injection in Frontend Dashboard and ProfileGrid WordPress Plugins

CVE-2026-103693: Unauthenticated PHP Object Injection in Two WordPress Plugins

CVE-2026-103693, published 2026-10-29 by WPScan, affects the Frontend Dashboard and ProfileGrid WordPress plugins. Neither prevents an unauthenticated user from storing a serialized PHP object in user metadata. The object is deserialized when a public profile is viewed, enabling PHP object injection that can lead to arbitrary file write and potentially remote code execution.

NVD lists a CVSS score of 9.0. Some trackers show NVD analysis as pending, and OffSeq rates it High, so treat the exact score as provisional.

Vulnerability Overview

Technical Analysis

User metadata fields written by these plugins accept attacker-controlled values without rejecting serialized PHP data. When a public profile page later reads that metadata, WordPress unserializes it automatically. If any class loaded in the request, from WordPress core, a plugin, or a theme, has a usable magic method such as __destruct or __wakeup, the attacker can build a POP chain to write files, and from there reach code execution.

The attack therefore has two stages: plant the payload (unauthenticated), then trigger it by loading the profile page, which an attacker can do themselves.

Exploitation Status

As of 2026-10-29, no public exploit code is indexed in Metasploit or Exploit-DB, and the CVE is not in CISA KEV. Deserialization bugs in popular WordPress plugins are usually weaponized quickly once details circulate.

Remediation

wp plugin update frontend-dashboard profilegrid-user-profiles-groups-and-communities
wp plugin list --fields=name,version,update | grep -i -E "frontend-dashboard|profilegrid"

1. Update Frontend Dashboard to 3.0.5 or later and ProfileGrid to 6.0.0.5 or later.
2. Audit user metadata for serialized objects in user profile fields, for example:

wp db query "SELECT user_id, meta_key FROM wp_usermeta WHERE meta_value LIKE '%O:%:\"%' LIMIT 50;"

3. Look for unexpected PHP files under wp-content/uploads/ and plugin directories.
4. Rotate credentials on any site where suspicious metadata or files are found.
5. Use a WAF rule that blocks serialized PHP object payloads in form submissions as a stopgap.

Key Takeaways

1. CVE-2026-103693 lets unauthenticated visitors plant a payload that executes through PHP deserialization.
2. Two plugins share the flaw: Frontend Dashboard (before 3.0.5) and ProfileGrid (before 6.0.0.5).
3. Patch now, then check user metadata for serialized objects.
4. Membership and profile plugins accept public input by design, so keep them on an auto-update schedule.

Sources

• CVE-2026-103693 — NIST NVD
• CVE-2026-103693 — VulDB