CVE-2026-123769
Deferred Deferred - Pending Action

Privilege Escalation in SureDash WordPress Plugin

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-123769
EUVD
EUVD-2026-124972

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
brainstormforce SureDash – Community, Courses & Member Dashboard From 0 (inc) to 1.13.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated attackers with Portal Manager access to escalate privileges to administrator. It exploits a flawed settings handler that permits arbitrary role changes, which are then applied to new user registrations via a public endpoint.

Detection Guidance

Check WordPress sites using SureDash plugin versions up to 1.13.0. Inspect logs for POST requests to /suredash/v1/save-settings and unauthenticated registrations via block-register endpoint. Look for changes to default_role setting in portal_settings option.

Impact Analysis

Attackers can create a new WordPress administrator account under their control. This grants full access to the site, enabling data theft, malware installation, or site takeover. Requires only Portal Manager-level access initially.

Mitigation Strategies
  • Update SureDash plugin to the latest version beyond 1.13.0 immediately.
  • Remove the custom manage_portal_dashboard capability from Portal Manager roles.
  • Audit all user accounts for unauthorized administrator roles.
  • Disable the block-register endpoint if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...