CVE-2025-2276: Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation
The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handlemoduleactions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/ultimate-dashboardto a version that resolves this vulnerability.Fixed in 3.8.7 - Configuration
Update the Ultimate Dashboard plugin so handle_module_actions includes the required capability/authorization check before allowing module activation/deactivation; the issue affects all versions up to and including 3.8.7.
Ultimate Dashboard (WordPress plugin) capability check on handle_module_actions function = Add missing authorization check to ensure only users with appropriate capabilities can activate/deactivate modules (Subscriber-level and above must be denied unless they have required capability).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2276?
CVE-2025-2276 has a medium severity due to the potential for unauthorized modification of data.
How do I fix CVE-2025-2276?
To fix CVE-2025-2276, upgrade the Ultimate Dashboard plugin to version 3.8.8 or later.
Who is affected by CVE-2025-2276?
CVE-2025-2276 affects all versions of the Ultimate Dashboard plugin up to and including 3.8.7.
What type of vulnerability is CVE-2025-2276?
CVE-2025-2276 is characterized as an unauthorized data modification vulnerability.
What function is responsible for the vulnerability in CVE-2025-2276?
The vulnerability in CVE-2025-2276 arises from a missing capability check in the handle_module_actions function.