WordPress Plugin Vulnerabilities

SureDash < 1.1.0 - Subscriber+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation due to the plugin not properly restricting a user's ability to set roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges.

Affects Plugins

Plugin icon
suredash
Fixed in 1.1.0

References

CVE
CVE-2025-48164
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa19840-04a0-4aa8-83c4-d0dca4e72e36

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Denver Jackson
Verified
No
WPVDB ID
4a8d430b-e07b-4459-ae57-36e0c966ac35

Timeline

Publicly Published
2025-07-28 (about 7 months ago)
Added
2025-08-05 (about 6 months ago)
Last Updated
2025-08-05 (about 6 months ago)

Other

Published
Title
Published
2025-03-06
Title
School Management System for Wordpress <= 93.0.0 - Student+ Account Takeover and Privilege Escalation
Published
2020-01-13
Title
Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)
Published
2025-04-03
Title
Woffice < 5.4.22 - Authentication Bypass via Registration Role
Published
2025-02-11
Title
WP Job Board Pro <= 1.2.76 - Unauthenticated Privilege Escalation
Published
2025-05-30
Title
WP-GeoMeta 0.3.4 - 0.3.5 - Subscriber+ Privilege Escalation