{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123769", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-11-06T13:59:04.747Z", "datePublished": "2026-11-13T09:35:11.454Z", "dateUpdated": "2026-11-13T09:35:11.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-13T09:35:11.454Z"}, "affected": [{"vendor": "brainstormforce", "product": "SureDash \u2013 Community, Courses & Member Dashboard", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.13.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SureDash \u2013 Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role."}], "title": "SureDash <= 1.13.0 - Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f317dcd-dc4f-482a-8faa-91cd9c022276?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/sanitizer.php#L101"}, {"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/settings.php#L604"}, {"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/services/router.php#L108"}, {"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/backend.php#L1309"}, {"url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/social-logins.php#L472"}, {"url": "https://plugins.trac.wordpress.org/changeset/3794229/suredash/trunk/core/routers/backend.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Wordfence PRISM"}], "timeline": [{"time": "2026-11-06T14:15:26.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-11-12T20:55:05.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SureDash \u2013 Community, Courses & Member Dashboard", "vendor": "brainstormforce", "versions": [{"lessThanOrEqual": "1.13.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SureDash \u2013 Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role."}], "id": "CVE-2026-123769", "lastModified": "2026-11-13T10:17:27.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-11-13T10:17:27.823", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/backend.php#L1309"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/core/routers/social-logins.php#L472"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/services/router.php#L108"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/sanitizer.php#L101"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/suredash/tags/1.13.0/inc/utils/settings.php#L604"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3794229/suredash/trunk/core/routers/backend.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f317dcd-dc4f-482a-8faa-91cd9c022276?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{}