{
 "id": "WPSEC-2026-3163",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3163/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3163/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3163/index.md",
 "title": "Ultimate Dashboard – Custom WordPress Dashboard <= 3.8.18 - Unauthenticated Sensitive Information Exposure of Custom Login URL via wp-admin Redirect",
 "description": "The Ultimate Dashboard plugin for WordPress is vulnerable to Sensitive Information Exposure via the wp-admin redirect in all versions up to, and including, 3.8.18, due to the wp-admin protection only being enabled when a wp-admin redirect slug is saved. The settings field shows '404' only as a placeholder, and when it is left empty, logged-out requests to /wp-admin/ are redirected to the custom login URL. This makes it possible for unauthenticated attackers to discover the secret custom login slug, which defeats the hidden login URL feature. Exploitation requires the custom login URL feature to be enabled without a wp-admin redirect slug.",
 "plugin": {
  "slug": "ultimate-dashboard",
  "name": "Ultimate Dashboard – Custom WordPress Dashboard",
  "full_name": "Ultimate Dashboard – Custom WordPress Dashboard",
  "wordpress_org": "https://wordpress.org/plugins/ultimate-dashboard/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ultimate-dashboard/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ultimate-dashboard"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.5",
    "from_inclusive": true,
    "to": "4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.5 before 4.0"
  ]
 },
 "introduced_in": "3.5",
 "fixed_in": "4.0",
 "remediation": "Update to 4.0 or later.",
 "fix_released": "2026-11-14T11:49:17+00:00",
 "published": "2026-11-15T12:43:38+00:00",
 "updated": "2026-11-14T16:17:07.749615+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3163/",
  "https://plugins.svn.wordpress.org/ultimate-dashboard/tags/4.0/",
  "https://wordpress.org/plugins/ultimate-dashboard/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ultimate-dashboard",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-15"
 }
}