{"id":"CVE-2026-110893","kind":"vulnerability","aliases":["CVE-2026-110893"],"related":[],"title":"SureDash WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.","summary":"SureDash, a WordPress plugin from Brainstorm Force, has a missing authorization check that allows access control settings to be exploited. The sources say the issue affects versions through 1.12.2 and carry a CVSS score of 5.3 with low exploitation probability.","severity":"medium","cvss":5.3,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","suredash","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureDash plugin version in the WordPress admin under Plugins; `1.12.2` or earlier is affected per the sources.","fix":"- Update SureDash to a version newer than `1.12.2`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-22T09:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:29+00:00","updated_at":"2026-10-25T04:20:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update SureDash to a version newer than `1.12.2`; the sources do not name the fixed version.","reach":"internet","title":"SureDash WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"SureDash, a WordPress plugin from Brainstorm Force, has a missing authorization check that allows access control settings to be exploited. The sources say the issue affects versions through 1.12.2 and carry a CVSS score of 5.3 with low exploitation probability.","category":"package","nicknames":[],"who_cares":["wordpress","suredash"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to restricted SureDash content or settings","analyst_note":"Confirm the fixed version and the exact unauthorized action from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110893.","how_to_check":"- Check the installed SureDash plugin version in the WordPress admin under Plugins; `1.12.2` or earlier is affected per the sources.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SureDash WordPress plugin at version `1.12.2` or earlier are affected. The sources do not say which configurations make a site exposed, so unknown for other setups.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000585,"input_tokens":3341,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110893':12A,15A '-2026':11A,14A '1.12.2':47B,81C '5.3':54B 'access':8A,33B,71C 'affect':44B,76C 'allow':32B,67C 'author':5A,29B,60C 'brainstorm':24B,63C 'carri':49B 'check':6A,30B 'configur':70C 'control':9A,34B,72C 'cve':10A,13A 'cvss':51B 'exploit':38B,57B,68C 'expos':7A 'forc':25B,64C 'incorrect':69C 'issu':43B,75C 'levels.this':74C 'low':56B 'miss':4A,28B,59C 'n/a':79C 'packag':16B 'plugin':3A,22B 'probabl':58B 'say':41B 'score':52B 'secur':73C 'set':35B 'sourc':40B 'suredash':1A,17B,19B,65C,66C,77C 'version':45B 'vulner':61C 'wordpress':2A,18B,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureDash WordPress plugin at version `1.12.2` or earlier are affected. The sources do not say which configurations make a site exposed, so unknown for other setups.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110893","severity":null,"published_at":"2026-10-22T09:17:13+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110893","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110893","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}