SureDash CVE-2026-110893

The target must be a WordPress site running the SureDash plugin at version 1.12.2 or earlier. Per the description, exploitation turns on 'incorrectly configured access control security levels,' so the realistic impact depends on the site's SureDash access-level configuration and which dashboard features are exposed - this is a limiting factor not captured by the raw CVSS score. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required, and the attack is network-based with low complexity, but the vulnerable endpoint and the concrete protected resource it exposes are not described in the available sources, so default-configuration exploitability cannot be confirmed from the provided data.

This is a moderate, not emergency-level, issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated access with no user interaction, which normally reads as easy to trigger; however, the impact is deliberately scoped low - C:L/I:N/A:N - meaning only limited confidentiality exposure (information disclosure) with no integrity or availability impact, consistent with CWE-862 Missing Authorization. That combination produces the 5.3 Medium base score and matches the vuln.today decision label of 'this_month' rather than act_now/emergency. Key corroborating signals are missing: there is no EPSS score, no CISA KEV listing, and no public PoC or exploit indicated in the input, so exploitation is currently theoretical rather than demonstrated. Exploitation status is therefore 'no public exploit identified at time of analysis' and must not be conflated with active exploitation. The most important caveat is that the description ('Exploiting Incorrectly Configured Access Control Security Levels') implies the real-world impact may depend on how the site operator has configured SureDash's access-control levels - verify the concrete exposed functionality with Patchstack/vendor before assuming default-config exploitability.

A remote, unauthenticated attacker sends a request directly to a SureDash plugin endpoint that fails to verify authorization, retrieving data or invoking functionality that should be restricted to higher access-control levels. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required, but impact is limited to confidentiality (C:L) - likely disclosure of restricted dashboard content rather than site takeover. No public PoC is identified in the available sources, so whether a reliable exploit exists is unverified.