CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed nonce validation conditional in the 'handle_module_actions' function. This makes it possible for unauthenticated attackers to toggle plugin modules on or off via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Ultimate Dashboard contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 3.8.14. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the dashboard without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page while authenticated to WordPress.
What an attacker can do
Perform unwanted dashboard actions on behalf of a logged-in administrator without their consent.
Potential impact on your site
Attackers can modify dashboard settings, create accounts, or change site configuration if an admin visits a malicious link.
Conditions required to exploit
Administrator must visit attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
