{"id":"CVE-2026-115604","kind":"vulnerability","aliases":["CVE-2026-115604"],"related":[],"title":"SureDash: subscriber accounts can delete arbitrary server files","description":"Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.","summary":"SureDash, a WordPress plugin, lets a logged-in subscriber delete arbitrary files on the site. An attacker with a basic subscriber account could remove files the site depends on.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","suredash","wordpress"],"not_affected_if":["no-public-subscriber-registration","plugin-not-installed"],"how_to_check":"- Check the installed SureDash plugin version in the WordPress admin under Plugins; affected versions are `1.12.3` and below.","fix":"- SureDash versions up to and including `1.12.3` are affected; move to a later release once the vendor publishes one.","status":"open","published_at":"2026-10-30T19:18:12+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:39+00:00","updated_at":"2026-10-30T19:26:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:39Z","model":"claude-haiku-5-5","output":{"fix":"- SureDash versions up to and including `1.12.3` are affected; move to a later release once the vendor publishes one.\n- unknown","reach":"internet","title":"SureDash: subscriber accounts can delete arbitrary server files","impact":"medium","summary":"SureDash, a WordPress plugin, lets a logged-in subscriber delete arbitrary files on the site. An attacker with a basic subscriber account could remove files the site depends on.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","suredash","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker deletes arbitrary server files via subscriber account","analyst_note":"Confirm the fixed version and whether registration must be open; check https://nvd.nist.gov/vuln/detail/CVE-2026-115604 for details.","how_to_check":"- Check the installed SureDash plugin version in the WordPress admin under Plugins; affected versions are `1.12.3` and below.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-public-subscriber-registration"],"who_is_affected":"Sites running the SureDash WordPress plugin at version 1.12.3 or earlier where users can register as subscribers. Sites without the plugin or without open subscriber registration have a smaller exposure; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4053,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115604':11A,14A '-2026':10A,13A '1.12.3':56C 'account':3A,43B 'arbitrari':6A,32B,51C 'attack':38B 'basic':41B 'could':44B 'cve':9A,12A 'delet':5A,31B,53C 'depend':49B 'file':8A,33B,46B,52C 'host':18B 'let':25B 'log':28B 'logged-in':27B 'packag':15B 'plugin':24B 'remov':45B 'self':17B 'self-host':16B 'server':7A 'site':36B,48B 'subscrib':2A,30B,42B,50C 'suredash':1A,19B,21B,55C 'version':57C 'wordpress':20B,23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureDash WordPress plugin at version 1.12.3 or earlier where users can register as subscribers. Sites without the plugin or without open subscriber registration have a smaller exposure; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115604","severity":null,"published_at":"2026-10-30T19:18:12+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}