What is the CVSS score of CVE-2026-54813?

CVE-2026-54813 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of SureDash are affected by CVE-2026-54813?

SureDash WordPress plugin (versions ≤1.8.0) contains a blind SQL injection vulnerability exploitable by low-privilege authenticated users, enabling direct access to sensitive WordPress database…

How to fix or mitigate CVE-2026-54813?

Within 24 hours: Audit all WordPress installations to identify instances running SureDash version 1.8.0 or below; document affected environments. Within 7 days: Implement database user privilege restrictions to minimum required scope; deploy Web Application Firewall rules targeting SQL injection patterns; disable or uninstall the vulnerable plugin until patched version is released. Within 30 days: Migrate to alternative WordPress dashboard solution if SureDash remains unpatched; complete security testing of replacement.

SureDash CVE-2026-54813

HIGH

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Suredash Brainstorm Force

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress plugin endpoint reachable by any authenticated low-privileged user (PR:L), no interaction; blind SQLi yields full DB read (C:H) with scope change beyond plugin, integrity unaffected.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:25 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection.

This issue affects SureDash: from n/a through 1.8.0.

AnalysisAI

Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.

Technical ContextAI

SureDash is a WordPress plugin developed by Brainstorm Force (the vendor behind popular plugins like Astra and SureCart) that provides dashboard functionality for membership and learning sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into SQL queries without proper parameterization or escaping. This is a blind variant, meaning the attacker does not receive direct query output but infers data via timing or boolean-based side channels, typically by sending many crafted requests against vulnerable endpoints in the plugin (likely AJAX or REST handlers exposed to authenticated WordPress users).

RemediationAI

Upstream fix availability is not independently confirmed from the provided data, so administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-plugin-1-8-0-sql-injection-vulnerability and upgrade SureDash to any release later than 1.8.0 once published by Brainstorm Force. Until a patched version is installed, compensating controls include disabling or deactivating the SureDash plugin entirely (loss of dashboard functionality), tightening WordPress user registration to prevent untrusted Subscriber-level accounts (side effect: blocks legitimate self-service signups), restricting access to the SureDash AJAX/REST endpoints via a WAF rule or .htaccess deny rules from non-admin IPs (may break legitimate frontend interactions), and enabling Patchstack or an equivalent virtual patching service which typically ships mitigation rules for plugin SQLi soon after disclosure.