CVE-2026-3140 is a Cross-Site Request Forgery vulnerability affecting the Ultimate Dashboard – Custom WordPress Dashboard plugin by davidvongries. The vulnerability is due to improper nonce validation in the 'handle_module_actions' function, which allows an attacker to perform unauthorized state-changing actions (toggling plugin modules) by tricking an authenticated administrator into submitting a forged request. This affects all plugin versions up to and including 3.8.14. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction and resulting in limited integrity impact without confidentiality or availability impact.

An attacker can cause an authenticated administrator to unknowingly toggle plugin modules on or off via a forged request. This could lead to unintended changes in the plugin's configuration, potentially affecting site functionality or security posture. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with unsolicited links or requests related to the Ultimate Dashboard plugin. Monitoring for updates from the vendor or plugin author is recommended to apply any forthcoming patches promptly.