Frontend Dashboard Privilege Escalation Vulnerability in WordPress

A privilege escalation vulnerability has been identified in the Frontend Dashboard plugin for WordPress, affecting versions 1.0 to 2.2.6. The issue arises from a missing capability check in the 'fed_wp_ajax_fed_login_form_post()' function, allowing unauthenticated attackers to reset the administrator's email and password, thereby gaining administrative privileges.

Impact

Exploitation of this vulnerability allows unauthenticated users to reset the administrator's email and password, granting them full administrative rights on the WordPress site.

Reproduction

To reproduce this vulnerability, send a POST request to the 'wp_ajax_fed_login_form_post' endpoint without the necessary authorization. Include a 'submit' field with the value 'reset_password' in the request payload. The absence of a capability check will allow the request to be processed, triggering the password reset for the administrator.

Remediation

Users are advised to update the Frontend Dashboard plugin to version 2.2.7 or later, where this vulnerability has been patched.