Live › vulnerability › CVE-2026-115604
SureDash, a WordPress plugin, lets a logged-in subscriber delete arbitrary files on the site. An attacker with a basic subscriber account could remove files the site depends on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the SureDash WordPress plugin at version 1.12.3 or earlier where users can register as subscribers. Sites without the plugin or without open subscriber registration have a smaller exposure; the sources do not say more.
No product ranges from the sources yet.
1.12.3 and below.1.12.3 are affected; move to a later release once the vendor publishes one.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-115604")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.