SureDash CVE-2026-115605

Exploitation requires an authenticated session on the target WordPress site: the CVSS vector specifies PR:L, so the attacker needs a valid low-privileged account on a site running the SureDash plugin at version 1.12.3 or earlier. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low attack complexity (AC:L). The specific SureDash feature, endpoint, or configuration whose access control is 'incorrectly configured' is not described in the available sources, so the exact function reachable through the missing authorization check is not confirmed. Limiting factors: the need for a pre-existing authenticated account bounds the attacker population, and impact is confined to confidentiality (C:L) with no integrity or availability effect.

This is a moderate-severity, lower-priority issue by the available signals, not a critical emergency. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable but authenticated flaw requiring at least low-level privileges, with only limited confidentiality impact and no integrity or availability impact - consistent with a CWE-862 Missing Authorization/broken access control weakness where a low-privileged account can reach a function or data it should not. The vuln.today decision label is 'this_month', signalling scheduled remediation rather than act_now or emergency urgency. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit is identified; the sole reference is the Patchstack advisory (the original reporter), not working exploit code. The signals are internally consistent - modest CVSS, no KEV, no PoC, a routine priority label - so this reads as a genuine-but-low real-world risk rather than a high-CVSS-but-overrated issue, or vice versa. Missing data: no EPSS, no independent vendor advisory beyond Patchstack, and the description does not state the exact feature or endpoint whose access control is misconfigured.

An attacker who already holds a low-privileged authenticated account on a WordPress site running SureDash ≤1.12.3 (for example a subscriber or similar low role) sends a request to a plugin function whose authorization check is missing or misconfigured, gaining read access to information or an action that should be restricted to higher-privileged users. No public exploit code is identified, and the limited confidentiality-only impact means the gain is disclosure of restricted data rather than site takeover.