# Ultimate Dashboard – Custom WordPress Dashboard <= 3.8.18 - Unauthenticated Protection Mechanism Bypass via Encoded wp-login.php Requests

- **ID:** WPSEC-2026-3162
- **Plugin:** Ultimate Dashboard – Custom WordPress Dashboard (`ultimate-dashboard`), https://wordpress.org/plugins/ultimate-dashboard/
- **Affected versions:** from 3.8.6 before 4.0
- **Fixed in:** 4.0 (Update to 4.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ultimate-dashboard
- **Fix released:** 2026-11-14
- **Published:** 2026-11-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3162/

## Description

The Ultimate Dashboard plugin for WordPress is vulnerable to a bypass of its custom login URL protection via percent-encoded requests to wp-login.php in all versions up to, and including, 3.8.18, due to the request URI being passed through sanitize_text_field(), which deletes percent-encoded characters instead of decoding them, before it is checked for 'wp-login.php'. A request such as /wp-log%69n.php still runs wp-login.php on the server but is not recognised as the old login page. This makes it possible for unauthenticated attackers to reach the default WordPress login page and its actions, or to be redirected to the custom login URL and learn its secret slug, even though the site owner enabled a custom login URL to hide it. Exploitation requires the custom login URL feature to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-3162/
- https://plugins.svn.wordpress.org/ultimate-dashboard/tags/4.0/
- https://wordpress.org/plugins/ultimate-dashboard/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3162/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.