SureDash EUVD-2026-109254

Exploitation requires an authenticated session with at least a low-privileged WordPress account on a site running SureDash from an unspecified initial version through 1.12.2 (PR:L). The flaw is a missing/misconfigured authorization check (CWE-862) on plugin functionality, so an attacker with such an account can access data intended for higher-privileged roles. The specific endpoint, role boundary crossed, and the exact data exposed are not described in the available sources. Limiting factors: a valid low-privileged account is needed (not fully unauthenticated), impact is confidentiality-only (no modification per I:N/A:N), and sites that do not permit untrusted user registration materially reduce the attacker population.

This is a medium-severity (CVSS 6.5) broken access control / missing authorization flaw (CWE-862) in the SureDash WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity attack that requires low-level privileges (PR:L, i.e. an authenticated but low-privileged account such as a subscriber) and no user interaction, yielding high confidentiality impact only, with no integrity or availability impact. The vuln.today Decision label is 'this_month', signalling a prioritized-but-not-emergency fix cadence rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the input, so there is no public evidence of active exploitation; the single reference is a Patchstack database entry (the reporter), which is an advisory record rather than a verified working exploit. In short, the C:H-only impact combined with a PR:L requirement makes this a genuine but moderate information-disclosure risk - a real patch priority for SureDash operators within the normal cycle, not a high-CVSS issue masquerading as critical, and not an emergency. Note the impact is read-only disclosure; the description does not establish any write/modify capability, consistent with I:N/A:N.

An attacker who holds a low-privileged authenticated account on a WordPress site running SureDash ≤ 1.12.2 sends requests to a plugin endpoint whose access-control check is missing or misconfigured, and thereby reads data that should be restricted to higher-privileged roles. Because AC:L and UI:N, no special timing or victim action is needed once the attacker has a valid low-level account. No public exploit code is identified in the provided data; the only reference is the Patchstack advisory.