{"id":"CVE-2026-110894","kind":"vulnerability","aliases":["CVE-2026-110894"],"related":[],"title":"SureDash WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.","summary":"SureDash, a WordPress plugin by Brainstorm Force, has a missing authorization check that lets a request reach functions it should restrict. The sources say an attacker can exploit incorrectly configured access control levels, and the affected range is all versions through 1.12.2.","severity":"medium","cvss":5.3,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","suredash","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed SureDash version in the WordPress admin under Plugins, or with `wp plugin get suredash --field=version`\n- Confirm whether the installed version is `1.12.2` or older","fix":"- Update SureDash to a version newer than `1.12.2`, once the vendor publishes one (unknown in the sources)\n- Review SureDash access control settings for communities or dashboards that should be restricted","status":"open","published_at":"2026-10-22T09:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:28+00:00","updated_at":"2026-10-25T04:20:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update SureDash to a version newer than `1.12.2`, once the vendor publishes one (unknown in the sources)\n- Review SureDash access control settings for communities or dashboards that should be restricted","reach":"internet","title":"SureDash WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"SureDash, a WordPress plugin by Brainstorm Force, has a missing authorization check that lets a request reach functions it should restrict. The sources say an attacker can exploit incorrectly configured access control levels, and the affected range is all versions through 1.12.2.","category":"package","nicknames":[],"who_cares":["wordpress","suredash"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may reach restricted SureDash content or actions","analyst_note":"Check the NVD entry and the Wordfence or vendor advisory for the affected endpoints, the required privilege level, and the fixed version.","how_to_check":"- Check the installed SureDash version in the WordPress admin under Plugins, or with `wp plugin get suredash --field=version`\n- Confirm whether the installed version is `1.12.2` or older","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running SureDash `1.12.2` or older are in scope, according to the sources. Exposure depends on how access levels are configured on the site, which the sources do not detail. Sites without SureDash installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3341,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110894':12A,15A '-2026':11A,14A '1.12.2':60B,83C 'access':8A,49B,73C 'affect':54B,78C 'allow':69C 'attack':44B 'author':5A,29B,62C 'brainstorm':24B,65C 'check':6A,30B 'configur':48B,72C 'control':9A,50B,74C 'cve':10A,13A 'exploit':46B,70C 'expos':7A 'forc':25B,66C 'function':36B 'incorrect':47B,71C 'issu':77C 'let':32B 'level':51B 'levels.this':76C 'miss':4A,28B,61C 'n/a':81C 'packag':16B 'plugin':3A,22B 'rang':55B 'reach':35B 'request':34B 'restrict':39B 'say':42B 'secur':75C 'sourc':41B 'suredash':1A,17B,19B,67C,68C,79C 'version':58B 'vulner':63C 'wordpress':2A,18B,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running SureDash `1.12.2` or older are in scope, according to the sources. Exposure depends on how access levels are configured on the site, which the sources do not detail. Sites without SureDash installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110894","severity":null,"published_at":"2026-10-22T09:17:13+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110894","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110894","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}