The Ultimate Dashboard plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 3.8.14. This vulnerability arises from improper nonce validation in the 'handle_module_actions' function, allowing an attacker to trick a site administrator into toggling plugin modules via a forged request.