CVE-2026-57401
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.
Risk Assessment
An attacker can read sensitive configuration files, user data, or other server resources, leading to information disclosure and potential attack escalation.
Recommendation
Immediately update the SureDash plugin to the latest available version that fixes this vulnerability. Also restrict file access permissions on the server.
Other vulnerabilities in SureDash
See all- CVE-2026-18402Medium
The SureDash – Community, Courses & Member Dashboard plugin for WordPress up to version 1.10.3 is vulnerable to Stored Cross-Site Scripting via the 'draweropenverposition' attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page. The payload is stored in JSON within an HTML comment, and missing esc_attr() allows breaking out of the attribute.
- CVE-2026-66698High
The SureDash plugin version 1.10.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.