{"id":"CVE-2026-115605","kind":"vulnerability","aliases":["CVE-2026-115605"],"related":[],"title":"SureDash WordPress plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.","summary":"SureDash, a WordPress plugin by Brainstorm Force, has a missing authorization check that lets access control settings be exploited. The sources do not say what data or actions an attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","suredash","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the SureDash plugin is installed and its version on the WordPress site (plugins list in wp-admin).\n- Compare the installed version against `1.12.3`; the sources list versions through `1.12.3` as affected.","fix":"- SureDash: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-10-29T15:17:17+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:08+00:00","updated_at":"2026-10-29T15:27:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:27:08Z","model":"claude-haiku-5-5","output":{"fix":"- SureDash: unknown; the sources do not name a fixed version.","reach":"unknown","title":"SureDash WordPress plugin: missing authorization check exposes access controls","impact":"medium","summary":"SureDash, a WordPress plugin by Brainstorm Force, has a missing authorization check that lets access control settings be exploited. The sources do not say what data or actions an attacker gains beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","suredash"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Access controls on SureDash content can be bypassed; details unknown","analyst_note":"Read the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115605) and the plugin changelog to find the fixed version and the exact access check missing.","how_to_check":"- Check whether the SureDash plugin is installed and its version on the WordPress site (plugins list in wp-admin).\n- Compare the installed version against `1.12.3`; the sources list versions through `1.12.3` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SureDash WordPress plugin up to and including version 1.12.3, per the NVD entry. The sources do not describe the exact configuration or role needed to exploit it, so whether a logged-out visitor can reach it is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4109,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115605':12A,15A '-2026':11A,14A '1.12.3':73C 'access':8A,33B,63C 'action':46B 'affect':68C 'allow':59C 'attack':48B 'author':5A,29B,52C 'beyond':50B 'brainstorm':24B,55C 'check':6A,30B 'configur':62C 'control':9A,34B,64C 'cve':10A,13A 'data':44B 'exploit':37B,60C 'expos':7A 'forc':25B,56C 'gain':49B 'incorrect':61C 'issu':67C 'let':32B 'levels.this':66C 'miss':4A,28B,51C 'n/a':71C 'packag':16B 'plugin':3A,22B 'say':42B 'secur':65C 'set':35B 'sourc':39B 'suredash':1A,17B,19B,57C,58C,69C 'vulner':53C 'wordpress':2A,18B,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureDash WordPress plugin up to and including version 1.12.3, per the NVD entry. The sources do not describe the exact configuration or role needed to exploit it, so whether a logged-out visitor can reach it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115605","severity":null,"published_at":"2026-10-29T15:17:17+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}