EUVD-2026-108056
GHSA-737v-56mc-g5fw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running SureDash ≤1.12.2
-
ExploitSend crafted unauthenticated request to protected endpoint
-
ExecutionBypass missing authorization check
-
ImpactRead unauthorized dashboard data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must run the SureDash WordPress plugin at version 1.12.2 or earlier. The description attributes exploitation to 'Incorrectly Configured Access Control Security Levels,' indicating the flaw involves SureDash's access-control/security-level configuration, but the available sources do not specify the exact feature, endpoint, or whether a non-default access-level configuration is required to trigger it. Limiting factors: impact is confined to low-level confidentiality exposure (no write or availability impact), and the dependence on how access-control levels are configured may mean some deployments are not exploitable; authentication is not required per the CVSS vector (PR:N). |
| Impact | This is a moderate-severity, low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, consistent with a Missing Authorization / broken access control weakness (CWE-862). However, impact is limited to low confidentiality only (C:L/I:N/A:N), yielding a 5.3 base score - the flaw appears to allow unauthorized read access to data or functionality rather than modification or takeover. No EPSS score, CISA KEV listing, or public PoC is present in the provided data, so there is no evidence of active exploitation; this aligns with the vuln.today 'this_month' decision label, which signals routine patching rather than emergency action. The signals are internally consistent (no conflict between CVSS and decision label), but note the description's phrase 'Incorrectly Configured Access Control Security Levels' suggests exploitability may depend on how the site operator configured SureDash's access levels - the description does not specify the exact triggering mechanism, so whether default configurations are affected is unverified. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running SureDash ≤1.12.2 and reaches a dashboard feature or data endpoint that should be protected by access-control checks, retrieving information they are not authorized to see. No public exploit code is identified in the provided data, and the low confidentiality-only impact means the attacker gains read exposure rather than control of the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).
RemediationAI
The supplied data does not name an exact fixed release; the primary remediation is to consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-plugin-1-12-2-broken-access-control-vulnerability?_s_id=cve and update SureDash to a release later than 1.12.2 once the vendor identifies it as patched. Patch availability is not explicitly stated in the supplied data, so confirm the fixed version with the vendor before upgrading. As a compensating control, review SureDash's access-control/security-level configuration and apply least-privilege settings, recognizing that the available sources do not confirm reconfiguration alone removes the missing authorization check. If SureDash is not required, deactivating the plugin removes the exposed functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SureDash is a WordPress plugin from Brainstorm Force; the CPE cpe:2.3:a:brainstorm_force:suredash:*:*:*:*:*:*:*:* identifies the plugin as the affected component, with no version constraints encoded in the CPE itself. CWE-862 (Missing Authorization) describes an application that fails to verify whether the requester holds the required capability or permission before granting access to a resource or function. The supplied sources do not identify the exact SureDash feature, REST route, AJAX action, shortcode, or file where the authorization check is missing, so the trigger is not described in the available sources. The description's phrase 'Incorrectly Configured Access Control Security Levels' and the Patchstack 'broken access control' label suggest the exposure may relate to how SureDash's access-level settings are configured, but whether a non-default configuration is required remains unverified. A supplied tag mentions 'Authentication Bypass'; however, the CVE description and CWE-862 mapping frame this as missing authorization, and the sources do not confirm a login-bypass mechanism. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates network reachability, low complexity, no privileges required, no user interaction, and low confidentiality-only impact.
Know when Suredash gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Missing authorization reachable remotely without credentials (AV:N/PR:N/AC:L); impact limited to unauthorized read access, so C:L and I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up t
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticate
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables r
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authentica
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-b
Exploit-DB