Ultimate Dashboard – Custom WordPress Dashboard <= 3.8.18 - Unauthenticated Sensitive Information Exposure of Custom Login URL via wp-admin Redirect
- ID
- WPSEC-2026-3163
- Plugin
- Ultimate Dashboard – Custom WordPress Dashboard (ultimate-dashboard)
- Affected
- from 3.5 before 4.0
- Remediation
- Update to 4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-15
- Attack surface
- Ultimate Dashboard – Custom WordPress Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Dashboard plugin for WordPress is vulnerable to Sensitive Information Exposure via the wp-admin redirect in all versions up to, and including, 3.8.18, due to the wp-admin protection only being enabled when a wp-admin redirect slug is saved. The settings field shows '404' only as a placeholder, and when it is left empty, logged-out requests to /wp-admin/ are redirected to the custom login URL. This makes it possible for unauthenticated attackers to discover the secret custom login slug, which defeats the hidden login URL feature. Exploitation requires the custom login URL feature to be enabled without a wp-admin redirect slug.
References
- https://wpsec.com/vuln/WPSEC-2026-3163/
- https://plugins.svn.wordpress.org/ultimate-dashboard/tags/4.0/
- https://wordpress.org/plugins/ultimate-dashboard/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS