What is the CVSS score of CVE-2026-57401?

CVE-2026-57401 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Wordpress Plugin are affected by CVE-2026-57401?

The SureDash WordPress plugin (versions ≤1.8.0) contains an arbitrary file deletion vulnerability allowing authenticated low-privilege users to remove critical WordPress files such as wp-config.php,…

How to fix or mitigate CVE-2026-57401?

Within 24 hours: immediately deactivate the SureDash plugin and restrict low-privilege user account creation or access to prevent exploitation. Within 7 days: audit all user accounts with low-privilege access, review access logs for suspicious file deletion activity, and implement file integrity monitoring for critical WordPress files (wp-config.php, wp-settings.php). Within 30 days: monitor Brainstorm Force and Patchstack for patch announcements; once available, upgrade to the patched version immediately. If no patch is released within 90 days, migrate to an alternative plugin or keep the plugin permanently deactivated.

Wordpress Plugin CVE-2026-57401

EUVD-2026-43473 CRITICAL

Path Traversal (CWE-22)

2026-07-13 Patchstack

WordPress Path Traversal Wordpress Plugin Suredash Brainstorm Force

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:59 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.9

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.

AnalysisAI

Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.