CVE-2025-2276 is a missing authorization vulnerability (CWE-862) in the Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress. The issue arises from the absence of a capability check in the handle_module_actions function, enabling authenticated users with low privileges (Subscriber-level and above) to modify plugin module states (activate/deactivate). This vulnerability affects all versions up to 3.8.7 and has a CVSS 3.1 base score of 4.3, reflecting a medium impact primarily on integrity. There is no indication of a patch or official fix at this time.

An attacker with authenticated access at Subscriber-level or higher can modify the activation status of plugin modules, potentially altering the plugin's behavior or functionality. This could lead to unauthorized changes in the WordPress dashboard environment but does not directly impact confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals and monitor for unauthorized changes to plugin modules. Avoid granting Subscriber-level or higher access to untrusted users.