CVE-2025-4473

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/function-admin.php#L3055
https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/layout/settings_tab/email/class-fed-email.php#L122
https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/route/class-fed-request.php#L35
https://plugins.trac.wordpress.org/changeset/3290623/
https://wordpress.org/plugins/frontend-dashboard/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3a10b5-b024-4b3f-af67-b7fcb997d368?source=cve

Configurations

No configuration.

History

13 May 2025, 19:35

Type	Values Removed	Values Added
Summary		(es) El complemento Frontend Dashboard para WordPress es vulnerable a la escalada de privilegios debido a la falta de una comprobación de capacidad en la función ajax_request() en las versiones 1.0 a 2.2.7. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, controlar el destino de los correos electrónicos salientes del complemento. Al apuntar SMTP a su propio servidor, los atacantes podrían capturar correos electrónicos de restablecimiento de contraseña dirigidos a administradores y elevar sus privilegios para obtener el control total del sitio.

13 May 2025, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-13 07:15

Updated : 2025-05-13 19:35

NVD link : CVE-2025-4473

Mitre link : CVE-2025-4473

CVE.ORG link : CVE-2025-4473

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

{"id": "CVE-2025-4473", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-05-13T07:15:52.637", "references": [{"url": "https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/function-admin.php#L3055", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/includes/admin/layout/settings_tab/email/class-fed-email.php#L122", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.7/route/class-fed-request.php#L35", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3290623/", "source": "security@wordfence.com"}, {"url": "https://wordpress.org/plugins/frontend-dashboard/#developers", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3a10b5-b024-4b3f-af67-b7fcb997d368?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover."}, {"lang": "es", "value": "El complemento Frontend Dashboard para WordPress es vulnerable a la escalada de privilegios debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n ajax_request() en las versiones 1.0 a 2.2.7. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, controlar el destino de los correos electr\u00f3nicos salientes del complemento. Al apuntar SMTP a su propio servidor, los atacantes podr\u00edan capturar correos electr\u00f3nicos de restablecimiento de contrase\u00f1a dirigidos a administradores y elevar sus privilegios para obtener el control total del sitio."}], "lastModified": "2025-05-13T19:35:18.080", "sourceIdentifier": "security@wordfence.com"}