The Frontend Dashboard plugin for WordPress suffers from improper control of code generation (CWE-94) due to inadequate filtering of callable methods/functions in the ajax_request() function. Authenticated attackers with subscriber-level privileges can exploit this flaw to invoke arbitrary functions, potentially escalating privileges by modifying user passwords. This vulnerability affects all versions up to 2.2.4 and has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated users with low privileges to execute arbitrary code, leading to privilege escalation and unauthorized password changes. This compromises user accounts and potentially the entire WordPress site’s security, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for suspicious activity related to the ajax_request() function. Avoid granting unnecessary privileges to users and consider disabling or replacing the Frontend Dashboard plugin if feasible.