Vulnerabilities / SureDash / WPSEC-2026-1426
SureDash <= 1.12.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via Image Source in Community Posts
Medium 6.4
CWE-918Fixed in 1.12.3
- ID
- WPSEC-2026-1426
- Plugin
- SureDash – Community, Courses & Member Dashboard (suredash)
- Affected
- all versions before 1.12.3
- Remediation
- Update to 1.12.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- SureDash on WPSec AttackSurface
- Fix released
- Published
Description
The SureDash plugin for WordPress is vulnerable to Blind Server-Side Request Forgery via the image source URL in community post content in all versions up to, and including, 1.12.2, due to the image preview processing calling getimagesize() on the src URL of images that have no height attribute and are not local attachments. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and probe internal services.
References
- https://wpsec.com/vuln/WPSEC-2026-1426/
- https://plugins.svn.wordpress.org/suredash/tags/1.12.3/
- https://wordpress.org/plugins/suredash/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS