SureDash CVE-2026-115604

Requires an authenticated low-privilege account (Subscriber level per the title; CVSS PR:L) on a WordPress site running the SureDash plugin at version 1.12.3 or earlier. The primary limiting factor is that valid authentication is needed, though WordPress sites with open user registration effectively lower this barrier to anyone. No user interaction is required (UI:N) and no non-default configuration is indicated in the available data. The specific plugin feature, parameter, or endpoint that performs the file deletion is not described in the available sources.

This is a moderate, not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and the title indicate a remotely reachable, low-complexity flaw exploitable by any authenticated low-privilege user (PR:L, described as a Subscriber) with no user interaction, which in WordPress is a meaningful exposure because Subscriber accounts are often self-registerable. However, the base score is only 5.0 because the vendor/Patchstack vector sets C:N/I:N/A:L - modeling arbitrary file deletion purely as a low availability impact. That mapping is debatable: destroying arbitrary files is fundamentally an integrity/availability loss, and in WordPress an arbitrary-file-deletion primitive can be escalated (e.g., deleting wp-config.php to force reinstallation and potential takeover), so the real-world impact may exceed the 5.0 score suggests. Decision framing from vuln.today is 'this_month' (a routine patch-cycle priority, not act_now/emergency). No EPSS score, no CISA KEV listing, and no proof-of-concept or working-exploit reference were provided - the only reference is the Patchstack database advisory itself. There is therefore no evidence of active exploitation; signals are consistent with a credible-but-not-urgent authenticated plugin bug. Key conflict to verify with the vendor: the 'file deletion' title versus the I:N impact rating.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running SureDash <= 1.12.3, then sends a crafted request to the vulnerable plugin endpoint supplying a traversal path to a file outside the intended directory, causing the server to delete it. Because AC:L/UI:N, no special timing or victim interaction is needed; deleting a sensitive file such as wp-config.php could degrade or compromise the site. No public exploit was identified at time of analysis.