Ultimate Dashboard for WordPress contains a Cross‑Site Request Forgery flaw (CWE‑352) in the nonce validation within the 'handle_module_actions' function. The broken check allows an attacker to craft a forged request that toggles the activation state of any installed module without requiring valid credentials. An attacker can exploit this by generating a link or email that an administrator clicks, which then sends the malicious request and enables or disables modules. The result is an unauthorized change to site configuration, potentially turning off security or access‑control modules and creating an opportunity for further compromise.

WordPress sites that have the Ultimate Dashboard – Custom WordPress Dashboard plugin installed in version 3.8.14 or earlier. No specific WordPress core version is tied to the issue; any site running a vulnerable plugin instance is affected.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. Its EPSS score is less than 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Although no direct authentication is required for the request, an attacker must rely on social engineering or a malicious link to get a site administrator to click, making the attack vector low‑barrier. The impact of disabling critical modules is significant enough to warrant timely remediation.