{
 "id": "WPSEC-2026-1426",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1426/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1426/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1426/index.md",
 "title": "SureDash <= 1.12.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via Image Source in Community Posts",
 "description": "The SureDash plugin for WordPress is vulnerable to Blind Server-Side Request Forgery via the image source URL in community post content in all versions up to, and including, 1.12.2, due to the image preview processing calling getimagesize() on the src URL of images that have no height attribute and are not local attachments. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and probe internal services.",
 "plugin": {
  "slug": "suredash",
  "name": "SureDash",
  "full_name": "SureDash – Community, Courses & Member Dashboard",
  "wordpress_org": "https://wordpress.org/plugins/suredash/",
  "advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.12.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.12.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.12.3",
 "remediation": "Update to 1.12.3 or later.",
 "fix_released": "2026-10-21T09:04:10+00:00",
 "published": "2026-10-22T09:43:07+00:00",
 "updated": "2026-10-21T13:33:50.331790+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1426/",
  "https://plugins.svn.wordpress.org/suredash/tags/1.12.3/",
  "https://wordpress.org/plugins/suredash/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}