EUVD-2026-43473Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Suredash gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.
Executive ViewAI
The SureDash WordPress plugin (versions ≤1.8.0) contains an arbitrary file deletion vulnerability allowing authenticated low-privilege users to remove critical WordPress files such as wp-config.php, enabling attackers to disrupt site operations or force complete reinstallation with takeover potential. All WordPress installations using this plugin face immediate risk to site availability and integrity.
Within 24 hours: immediately deactivate the SureDash plugin and restrict low-privilege user account creation or access to prevent exploitation. Within 7 days: audit all user accounts with low-privilege access, review access logs for suspicious file deletion activity, and implement file integrity monitoring for critical WordPress files (wp-config.php, wp-settings.php). Within 30 days: monitor Brainstorm Force and Patchstack for patch announcements; once available, upgrade to the patched version immediately. If no patch is released within 90 days, migrate to an alternative plugin or keep the plugin permanently deactivated.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate SureDash plugin immediately or restrict to administrator accounts only; (2) Implement file-level access controls limiting low-privilege users' directory traversal capabilities; (3) Deploy file integrity monitoring (FIM) on critical WordPress files (wp-config.php, wp-settings.php); (4) Enable detailed WordPress audit logging for file operations; (5) Restrict file system access for low-privilege user roles; (6) Deploy WAF rules blocking path traversal patterns (../) in plugin requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticate
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables r
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authentica
Stored cross-site scripting in the Brainstorm Force SureDash WordPress plugin affects versions through 1.12.3; an authen
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-b
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity
Arbitrary file deletion in the SureDash WordPress plugin through version 1.12.3 allows an authenticated low-privilege us
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.3 lets an authenticated low-privile
GitHub PoC
Exploit-DB