SureDash <= 1.13.0 — Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under SureDash – Community, Courses & Member Dashboard.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 1.13.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch SureDash – Community, Courses & Member Dashboard to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which authorizes any holder of the custom `manage_portal_dashboard` capability (Portal Manager role) without requiring `promote_users`, `edit_users`, or `manage_options`, combined with `sanitize_settings_data()` iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as `default_role` to pass through `sanitize_text_field()` unchanged and be persisted into the `portal_settings` option via `update_option()` with no role-validity check. This makes it possible for authenticated attackers with Portal Manager-level access and above to poison the `default_role` setting to `administrator`, after which any subsequent new-user registration through the publicly accessible block-register endpoint reads the corrupted setting and passes it directly to `wp_insert_user()`, producing a full WordPress Administrator account under the attacker's control. The exploit requires two steps: a POST to the authenticated `save-settings` endpoint to overwrite `default_role`, followed by triggering a new registration through the unauthenticated block-register endpoint to receive the escalated account. Successful exploitation causes the attacker's own account to receive the complete administrator role.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Nov 12, 2026

   CVE published

   Severity high, CVSS 8.8

2. Nov 13, 2026

   Record last updated