SureDash WordPress plugin: low-privilege users can become administrators

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the save_settings() REST handler at /suredash/v1/save-settings being gated only by admin_permission_callback(), which authorizes any holder of the custom manage_portal_dashboard capability (Portal Manager role) without requiring promote_users, edit_users, or manage_options, combined with sanitize_settings_data() iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as default_role to pass through sanitize_text_field() unchanged and be persisted into the portal_settings option via update_option() with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the setting to , after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to , producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated endpoint to overwrite , followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role.