# Ultimate Dashboard – Custom WordPress Dashboard <= 3.8.18 - Unauthenticated Sensitive Information Exposure of Custom Login URL via wp-admin Redirect

- **ID:** WPSEC-2026-3163
- **Plugin:** Ultimate Dashboard – Custom WordPress Dashboard (`ultimate-dashboard`), https://wordpress.org/plugins/ultimate-dashboard/
- **Affected versions:** from 3.5 before 4.0
- **Fixed in:** 4.0 (Update to 4.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ultimate-dashboard
- **Fix released:** 2026-11-14
- **Published:** 2026-11-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3163/

## Description

The Ultimate Dashboard plugin for WordPress is vulnerable to Sensitive Information Exposure via the wp-admin redirect in all versions up to, and including, 3.8.18, due to the wp-admin protection only being enabled when a wp-admin redirect slug is saved. The settings field shows '404' only as a placeholder, and when it is left empty, logged-out requests to /wp-admin/ are redirected to the custom login URL. This makes it possible for unauthenticated attackers to discover the secret custom login slug, which defeats the hidden login URL feature. Exploitation requires the custom login URL feature to be enabled without a wp-admin redirect slug.

## References

- https://wpsec.com/vuln/WPSEC-2026-3163/
- https://plugins.svn.wordpress.org/ultimate-dashboard/tags/4.0/
- https://wordpress.org/plugins/ultimate-dashboard/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3163/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.