Ultimate Dashboard – Custom WordPress Dashboard <= 3.8.18 - Unauthenticated Protection Mechanism Bypass via Encoded wp-login.php Requests
- ID
- WPSEC-2026-3162
- Plugin
- Ultimate Dashboard – Custom WordPress Dashboard (ultimate-dashboard)
- Affected
- from 3.8.6 before 4.0
- Remediation
- Update to 4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-693
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-15
- Attack surface
- Ultimate Dashboard – Custom WordPress Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Dashboard plugin for WordPress is vulnerable to a bypass of its custom login URL protection via percent-encoded requests to wp-login.php in all versions up to, and including, 3.8.18, due to the request URI being passed through sanitize_text_field(), which deletes percent-encoded characters instead of decoding them, before it is checked for 'wp-login.php'. A request such as /wp-log%69n.php still runs wp-login.php on the server but is not recognised as the old login page. This makes it possible for unauthenticated attackers to reach the default WordPress login page and its actions, or to be redirected to the custom login URL and learn its secret slug, even though the site owner enabled a custom login URL to hide it. Exploitation requires the custom login URL feature to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-3162/
- https://plugins.svn.wordpress.org/ultimate-dashboard/tags/4.0/
- https://wordpress.org/plugins/ultimate-dashboard/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS