SureDash CVE-2026-54813

Exploitation requires the SureDash plugin to be installed and activated on a WordPress site at version 1.8.0 or earlier, and the attacker must hold valid credentials for an authenticated WordPress account (PR:L from the CVSS vector indicates a low-privileged role such as Subscriber or Contributor is sufficient - admin rights are not needed). No user interaction is required (UI:N) and the attack is launched over the network (AV:N) against the vulnerable plugin endpoints. Exploitation is limited by the need for at least one valid login on the target site; sites that disable open user registration and enforce strong authentication on existing accounts materially reduce exposure.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L indicates network-reachable, low-complexity exploitation requiring only low privileges (any authenticated WordPress user role, potentially Subscriber) and no user interaction, with a scope change reflecting that SQL access reaches the entire WordPress database beyond the plugin's own context. Confidentiality impact is High (full database read) while integrity is None and availability is Low - consistent with a read-oriented blind SQLi. EPSS data is not provided and the CVE is not listed in CISA KEV, so this is no public exploit identified at time of analysis and likely opportunistic rather than mass-exploited today. However, WordPress plugin SQLi flaws are routinely weaponized by automated scanners within weeks of disclosure, so the practical risk for any site running SureDash <= 1.8.0 with open user registration is meaningful.

An attacker registers a low-privileged account on a WordPress site running SureDash <= 1.8.0 (or uses any existing low-privileged credential) and sends crafted requests to a vulnerable plugin endpoint that concatenates input into a SQL query. Using boolean or time-based blind techniques, they iteratively extract WordPress user password hashes, secret keys, or PII from custom tables. No public exploit identified at time of analysis, but blind SQLi is well within reach of automated tools like sqlmap.