CVE-2026-103693：Frontend Dashboard 3.0.5以下與 ProfileGrid 6.0.0.5以下易受未授權 PHP 物件注入攻擊
CVE-2026-103693 - Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
CVE-2026-103693 發現於 Frontend Dashboard 3.0.5 以下與 ProfileGrid 6.0.0.5 以下的 WordPress 外掛，未授權使用者可將序列化 PHP 物件存入使用者資料，於公開個人檔案時被反序列化，導致任意檔案寫入與遠端程式執行。
此漏洞可讓未授權使用者寫檔並執行程式，提醒站長即時升級外掛以避免被利用，並可作為其他型別 PHP 注入攻擊的參考案例。
譯文尚未完整，完整內容請切換至原文。
Frontend Dashboard WordPress 外掛在 3.0.5 之前，以及 ProfileGrid WordPress 外掛在 6.0.0.5 之前，未能阻止未經授權的使用者在使用者資料中儲存序列化的 PHP 物件，該物件在公開個人資料被檢視時會被反序列化，允許 PHP 物件注入，可能導致任意檔案寫入與遠端程式碼執行。
Impact
Affected Products
The following products are affected by CVE-2026-103693
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Metagauss | profilegrid |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | 關鍵 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Update WordPress plugins to prevent PHP object injection and arbitrary file write vulnerabilities.
- Update Frontend Dashboard to 3.0.5 or later.
- Update ProfileGrid to 6.0.0.5 or later.
- Review and sanitize all user metadata.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-103693.
| URL | Resource |
|---|---|
| https://wpscan.com/vulnerability/c156065f-76f1-4f44-bc57-b7d57560813f/ |
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-103693 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-103693
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-103693 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-103693 vulnerability over time.
漏洞歷史細節對於瞭解漏洞演變、以及辨識可能影響漏洞嚴重性、可利用性或其他特徵的最新變更都很有用。
-
CVE 已修改 由 134c704f-9b21-4f2e-91b3-4a467353bcc0
十月. 29, 2026
操作 型別 舊值 新值 新增 CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H 新增 CWE CWE-502 新增 SSVC {'id': 'CVE-2026-103693', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-29T10:51:37.238576Z'} -
新 CVE 收到 由 [email protected]
十月. 29, 2026
操作 型別 舊值 新值 新增 描述 Frontend Dashboard WordPress 外掛程式 3.0.5 以前，ProfileGrid WordPress 外掛程式 6.0.0.5 以前未阻止未經授權的使用者在使用者元資料中儲存序列化的 PHP 物件，該物件在檢視公開個人檔案時被反序列化，允許 PHP 物件注入，可能導致任意檔案寫入和潛在的遠端程式執行。 新增 受影響者 New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/103xxx/CVE-2026-103693.json">CVE-2026-103693</a> 新增 參考 https://wpscan.com/vulnerability/c156065f-76f1-4f44-bc57-b7d57560813f/
EPSS 是對未來 30 天內觀測到利用活動的機率的每日估計 以下圖表顯示該漏洞的 EPSS 分數歷史。