---
id: "CVE-2026-123769"
page: "https://infrastack.ai/live/CVE-2026-123769"
kind: "vulnerability"
aliases: ["CVE-2026-123769"]
title: "SureDash WordPress plugin: low-privilege users can become administrators"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "SureDash", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "self-hosted", "suredash", "wordpress"]
not_affected_if: ["no-portal-manager-users", "plugin-not-installed", "registration-closed"]
published_at: "2026-11-13T10:17:27+00:00"
first_seen_at: "2026-11-13T10:47:11+00:00"
updated_at: "2026-11-13T10:49:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123769", "first_seen_at": "2026-11-13T10:47:11+00:00"}]
exploit_sources: []
---

# SureDash WordPress plugin: low-privilege users can become administrators

Link for people: https://infrastack.ai/live/CVE-2026-123769 (this .md is for agents)

The SureDash WordPress plugin lets a user with the Portal Manager role overwrite the default registration role to administrator through its settings REST endpoint. A later public registration then creates a full WordPress administrator account controlled by the attacker.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SureDash affected range not listed fixed no fixed version listed

## How to check

- Check whether the SureDash plugin is installed and its version in the WordPress admin plugins list
- Review whether any users hold the Portal Manager role (`manage_portal_dashboard` capability)
- Check the `default_role` value in the `portal_settings` option (e.g. `wp option get portal_settings --format=json`) for an administrator role

## Fix

- SureDash plugin: versions up to and including `1.13.0` are affected; the sources do not state a fixed version

## Timeline

- 2026-11-13T10:47:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123769

## From the sources

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_