CVE-2025-2276

Name of the Vulnerable Software and Affected Versions The Ultimate Dashboard – Custom WordPress Dashboard plugin versions up to, and including, 3.8.7

Description The issue is related to unauthorized modification of data due to a missing capability check on the handle module actions function. This allows authenticated attackers with Subscriber-level access and above to activate or deactivate plugin modules.

Recommendations For versions up to, and including, 3.8.7, update to a version that includes a fix for the missing capability check in the handle module actions function. As a temporary workaround, consider restricting access to the handle module actions function to prevent unauthorized modification of data.