What is the CVSS score of CVE-2026-3140?

CVE-2026-3140 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Ultimate Dashboard CVE-2026-3140

EUVD-2026-26496 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-01 Wordfence

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 12:00 vuln.today

EUVD ID Assigned

May 01, 2026 - 11:45 euvd

EUVD-2026-26496

Analysis Generated

May 01, 2026 - 11:45 vuln.today

CVE Published

May 01, 2026 - 11:18 nvd

MEDIUM 4.3

DescriptionCVE.org

The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed nonce validation conditional in the 'handle_module_actions' function. This makes it possible for unauthenticated attackers to toggle plugin modules on or off via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Ultimate Dashboard for WordPress up to version 3.8.14 allows unauthenticated attackers to toggle plugin modules on or off by tricking site administrators into clicking a malicious link. The vulnerability stems from flawed nonce validation in the 'handle_module_actions' function, enabling attackers to modify plugin configuration without user consent. No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

Ultimate Dashboard is a WordPress plugin that manages custom dashboard configurations and modules. The vulnerability exists in the 'handle_module_actions' function within the feature module component, where a conditional nonce validation check fails to properly verify request authenticity. CSRF attacks exploit the trust browsers place in authenticated sessions by injecting forged requests into that session context. CWE-352 (Cross-Site Request Forgery) describes the root cause: insufficient validation of the origin and intent of user-initiated requests. The plugin fails to properly validate WordPress nonces, which are cryptographic tokens designed to prevent CSRF attacks by ensuring requests originate from legitimate sources.

RemediationAI

Update Ultimate Dashboard to the patched version released after 3.8.14 via the WordPress plugin dashboard (Plugins > Installed Plugins > Ultimate Dashboard > Update) or directly from https://plugins.wordpress.org/ultimate-dashboard/. Verify the nonce validation fix in the 'handle_module_actions' function via the changelog at https://plugins.trac.wordpress.org/changeset/3479396/. As a temporary workaround pending update, restrict administrative access to trusted users only and educate site administrators not to click suspicious links while logged in. Additionally, consider implementing Content Security Policy (CSP) headers to mitigate CSRF attack delivery, though this does not replace patching. Monitor audit logs for unexpected module state changes that may indicate exploitation attempts.