A Frontend Dashboard WordPress vulnerability, rated 9.0 out of 10 per the NVD listing, affects sites that display member profiles. If your site uses this plugin or ProfileGrid, we recommend moving to the patched versions without delay.
What is it?
The affected plugins accept information submitted by a visitor who has not logged in, then process it when a public profile page is viewed.
A plugin is a module added to a WordPress site for an additional function, here the management of member profiles. According to the NVD listing for CVE-2026-103693, the affected versions do not prevent a visitor without an account from having a booby-trapped piece of data recorded, which the site later interprets. The listing mentions file writing on the server (the computer that hosts the site) and possible remote code execution, meaning takeover from outside.
It’s like a drop box at the entrance of the corner store: anyone can slip in a note, and the shopkeeper follows the instructions it contains without checking what’s being asked. The problem isn’t who drops the note, it’s that its content gets carried out without any check.
Why is it serious?
The score is 9.0 out of 10 per the NVD listing, and no credentials are needed to take advantage of it.
This score comes from the CVSS 3.1 scale, the international benchmark used to compare the severity of vulnerabilities; it was assigned by the reporting organization (CNA), according to the NVD listing. No exploitation is reported in the listings consulted, namely the NVD listing and the WPScan advisory for the same vulnerability. This does not establish that no exploitation has occurred, and the severity assigned, along with the lack of any credentials required, justify acting without delay.
A compromise could make a showcase site unavailable for the duration of repairs. Personal information belonging to members or clients could also be exposed. These consequences are possible, and we are not attaching them to any observed exploitation.
Who is affected?
Frontend Dashboard versions earlier than 3.0.5, and ProfileGrid versions earlier than 6.0.0.5.
The patched versions are 3.0.5 for Frontend Dashboard and 6.0.0.5 for ProfileGrid, according to the NVD listing. The listing does not specify the publisher. These plugins power sites that publish profiles: associations and non-profits with a member directory, professional orders and associations, sports clubs. Add to that SMBs whose site offers a client area or introduces a team.
How do I check my business?
The question is whether one of these plugins is installed, and which version.
- Ask who is responsible for the site and its upkeep: an in-house webmaster, an agency, or a hosting provider. Management should note the answer.
- Open the Plugins section of the WordPress dashboard and check whether Frontend Dashboard or ProfileGrid appears there, and in which version.
- Have the provider confirm that plugin patches are applied and that recent backups can be restored.
Scenario
Fictional example: a dental clinic whose site displays team profiles and an area for registered patients.
Plugin patches have not been applied for months. One morning the site stops responding, and the host flags unfamiliar files. Online appointment booking goes down, the front desk switches to phone calls, and a day is spent restoring a backup. The clinic logs the event in its register, then assesses whether patient information may have been accessed. It’s this assessment of the risk of serious harm that will determine whether the Commission d’accès à l’information (Quebec’s privacy regulator) and the people concerned must be notified.
What the Frontend Dashboard WordPress vulnerability changes for organizations here
In Quebec, the Act respecting the protection of personal information in the private sector requires keeping a register of confidentiality incidents. It requires notifying the Commission d’accès à l’information (Quebec’s privacy regulator) and the people concerned when there is a risk of serious harm. We distinguish between the vulnerability (a flaw present in software), the compromise (a successful attack), and the confidentiality incident, which alone triggers these obligations. A vulnerable profile page does not automatically qualify. The Canadian Centre for Cyber Security also lists patching among its baseline controls.
What to do now
- Back up the entire site, files and database (where the site stores text, accounts, and profiles), before making any changes.
- Check whether Frontend Dashboard and ProfileGrid are installed, and in which version, from the dashboard.
- Install Frontend Dashboard 3.0.5 or later, ProfileGrid 6.0.0.5 or later.
- Deactivate the plugin if the patch cannot be applied quickly, then confirm next steps with the host or webmaster.
- Ask the webmaster to review recently modified files and recently created accounts.
FAQ
Our site is small, are we really affected?
The organization’s size is not a factor. What determines exposure is the plugin installed and its version, not the number of visitors. So the relevant question isn’t your size, but the version of your plugins.
Should we act even if no attack has been reported?
Yes. No exploitation is reported in the listings consulted, but the vulnerability is public and the score assigned is high. Applying the patched version now significantly reduces exposure.
Once we’ve updated, are we in the clear?
For this specific vulnerability, running the patched version closes the door. It says nothing about a compromise that may have occurred beforehand. Fixing the flaw and checking whether a site has already been affected are two separate steps; the second requires reviewing the site with your webmaster or host. Beyond that, there is no absolute protection: be wary of any claim promising zero risk. What holds up is a patching routine, tested backups, and a designated person responsible.
Sources
- CVE-2026-103693 listing from the National Vulnerability Database · NIST, October 29, 2026
- Security advisory (wpscan.com) · wpscan.com
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline reference checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-103693
Article prepared by RISS Canada’s intelligence monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
