{"id":"CVE-2026-123769","kind":"vulnerability","aliases":["CVE-2026-123769"],"related":[],"title":"SureDash WordPress plugin: low-privilege users can become administrators","description":"The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role.","summary":"The SureDash WordPress plugin lets a user with the Portal Manager role overwrite the default registration role to administrator through its settings REST endpoint. A later public registration then creates a full WordPress administrator account controlled by the attacker.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SureDash","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","suredash","wordpress"],"not_affected_if":["no-portal-manager-users","plugin-not-installed","registration-closed"],"how_to_check":"- Check whether the SureDash plugin is installed and its version in the WordPress admin plugins list\n- Review whether any users hold the Portal Manager role (`manage_portal_dashboard` capability)\n- Check the `default_role` value in the `portal_settings` option (e.g. `wp option get portal_settings --format=json`) for an administrator role","fix":"- SureDash plugin: versions up to and including `1.13.0` are affected; the sources do not state a fixed version","status":"open","published_at":"2026-11-13T10:17:27+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","triaged_at":"2026-11-13T10:49:06+00:00","updated_at":"2026-11-13T10:49:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:49:06Z","model":"claude-haiku-5-5","output":{"fix":"- SureDash plugin: versions up to and including `1.13.0` are affected; the sources do not state a fixed version","reach":"internet","title":"SureDash WordPress plugin: low-privilege users can become administrators","impact":"high","summary":"The SureDash WordPress plugin lets a user with the Portal Manager role overwrite the default registration role to administrator through its settings REST endpoint. A later public registration then creates a full WordPress administrator account controlled by the attacker.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","suredash","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker becomes a WordPress administrator, full site control","analyst_note":"Find the fixed version of the SureDash plugin after 1.13.0 on the WordPress plugin page or NVD, since no source here states it.","how_to_check":"- Check whether the SureDash plugin is installed and its version in the WordPress admin plugins list\n- Review whether any users hold the Portal Manager role (`manage_portal_dashboard` capability)\n- Check the `default_role` value in the `portal_settings` option (e.g. `wp option get portal_settings --format=json`) for an administrator role","plain_action":"","product_name":"SureDash","needs_analyst":true,"not_affected_if":["no-portal-manager-users","registration-closed","plugin-not-installed"],"who_is_affected":"Sites running the SureDash plugin version 1.13.0 or earlier are exposed when they give users the Portal Manager role. The exploit needs a Portal Manager account first, then public user registration to be open so the poisoned default role is used. Sites without SureDash, without Portal Manager users, or with registration closed are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000828,"input_tokens":4950,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123769':13A,16A '-2026':12A,15A '/suredash/v1/save-settings':95C '1.13.0':84C 'access':185C,207C 'account':58B,229C,270C,278C 'admin':100C 'administr':10A,42B,57B,195C,228C,283C 'allow':140C,142C 'allow-list':139C 'arbitrari':143C 'attack':62B,134C,179C,232C,275C 'attacker-suppli':133C 'authent':178C,244C 'author':104C 'becom':9A 'block':209C,263C 'block-regist':208C,262C 'callback':102C 'capabl':113C 'caus':273C 'check':172C 'combin':126C 'communiti':65C 'complet':282C 'control':59B,234C 'corrupt':214C 'cours':66C 'creat':53B 'custom':109C 'cve':11A,14A 'dashboard':68C,112C 'data':130C 'default':38B,147C,191C,251C 'direct':219C 'due':87C 'edit':121C 'endpoint':47B,211C,248C,265C 'escal':76C,269C 'exploit':236C,272C 'field':154C 'follow':253C 'full':55B,226C 'gate':97C 'handler':93C 'holder':106C 'host':21B 'includ':83C 'insert':222C 'iter':131C 'key':136C,144C 'later':49B 'let':28B 'level':184C 'list':141C 'low':5A 'low-privileg':4A 'make':174C 'manag':34B,110C,115C,124C,183C 'manager-level':182C 'member':67C 'new':201C,257C 'new-us':200C 'option':125C,163C,166C 'overwrit':36B,250C 'packag':18B 'pass':150C,217C 'permiss':101C 'persist':158C 'plugin':3A,27B,69C 'poison':189C 'portal':33B,111C,114C,161C,181C 'possibl':176C 'post':241C 'privileg':6A,75C 'produc':224C 'promot':119C 'public':50B,206C 'read':212C 'receiv':267C,280C 'regist':210C,264C 'registr':39B,51B,203C,258C 'requir':118C,237C 'rest':46B,92C 'role':35B,40B,116C,148C,170C,192C,252C,284C 'role-valid':169C 'sanit':128C,152C 'save':90C,246C 'save-set':245C 'self':20B 'self-host':19B 'set':45B,91C,129C,162C,193C,215C,247C 'step':239C 'subsequ':199C 'success':271C 'suppli':135C 'suredash':1A,17A,22B,25B,64C 'text':153C 'trigger':255C 'two':238C 'unauthent':261C 'unchang':155C 'updat':165C 'user':7A,30B,120C,122C,202C,223C 'valid':171C 'version':79C 'via':164C 'vulner':73C 'without':117C 'wordpress':2A,23B,26B,56B,71C,227C 'wp':221C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SureDash plugin version 1.13.0 or earlier are exposed when they give users the Portal Manager role. The exploit needs a Portal Manager account first, then public user registration to be open so the poisoned default role is used. Sites without SureDash, without Portal Manager users, or with registration closed are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["suredash"],"ptokens":["suredash"],"labels":["high","package","selfhosted","suredash","vendor","wordpress"],"campaign_type":null,"search_a":"'-123769':13A,16A '-2026':12A,15A 'administr':10A 'becom':9A 'cve':11A,14A 'low':5A 'low-privileg':4A 'plugin':3A 'privileg':6A 'suredash':1A,17A 'user':7A 'wordpress':2A","search_b":"'account':58B 'administr':42B,57B 'attack':62B 'control':59B 'creat':53B 'default':38B 'endpoint':47B 'full':55B 'host':21B 'later':49B 'let':28B 'manag':34B 'overwrit':36B 'packag':18B 'plugin':27B 'portal':33B 'public':50B 'registr':39B,51B 'rest':46B 'role':35B,40B 'self':20B 'self-host':19B 'set':45B 'suredash':22B,25B 'user':30B 'wordpress':23B,26B,56B","search_c":"'/suredash/v1/save-settings':95C '1.13.0':84C 'access':185C,207C 'account':229C,270C,278C 'admin':100C 'administr':195C,228C,283C 'allow':140C,142C 'allow-list':139C 'arbitrari':143C 'attack':134C,179C,232C,275C 'attacker-suppli':133C 'authent':178C,244C 'author':104C 'block':209C,263C 'block-regist':208C,262C 'callback':102C 'capabl':113C 'caus':273C 'check':172C 'combin':126C 'communiti':65C 'complet':282C 'control':234C 'corrupt':214C 'cours':66C 'custom':109C 'dashboard':68C,112C 'data':130C 'default':147C,191C,251C 'direct':219C 'due':87C 'edit':121C 'endpoint':211C,248C,265C 'escal':76C,269C 'exploit':236C,272C 'field':154C 'follow':253C 'full':226C 'gate':97C 'handler':93C 'holder':106C 'includ':83C 'insert':222C 'iter':131C 'key':136C,144C 'level':184C 'list':141C 'make':174C 'manag':110C,115C,124C,183C 'manager-level':182C 'member':67C 'new':201C,257C 'new-us':200C 'option':125C,163C,166C 'overwrit':250C 'pass':150C,217C 'permiss':101C 'persist':158C 'plugin':69C 'poison':189C 'portal':111C,114C,161C,181C 'possibl':176C 'post':241C 'privileg':75C 'produc':224C 'promot':119C 'public':206C 'read':212C 'receiv':267C,280C 'regist':210C,264C 'registr':203C,258C 'requir':118C,237C 'rest':92C 'role':116C,148C,170C,192C,252C,284C 'role-valid':169C 'sanit':128C,152C 'save':90C,246C 'save-set':245C 'set':91C,129C,162C,193C,215C,247C 'step':239C 'subsequ':199C 'success':271C 'suppli':135C 'suredash':64C 'text':153C 'trigger':255C 'two':238C 'unauthent':261C 'unchang':155C 'updat':165C 'user':120C,122C,202C,223C 'valid':171C 'version':79C 'via':164C 'vulner':73C 'without':117C 'wordpress':71C,227C 'wp':221C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123769","severity":null,"published_at":"2026-11-13T10:17:27+00:00","modified_at":"2026-11-13T10:17:27+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","fetched_at":"2026-11-13T10:47:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}