SureDash <= 1.12.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Unapproved Comments in Comment Lists

ID

WPSEC-2026-1429

Plugin

SureDash – Community, Courses & Member Dashboard (suredash)

Affected

all versions before 1.12.3

Remediation

Update to 1.12.3 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-284

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

SureDash on WPSec AttackSurface

Fix released

2026-10-21

Published

2026-10-22

Description

The SureDash plugin for WordPress is vulnerable to Sensitive Information Exposure via the community comment lists in all versions up to, and including, 1.12.2, due to the comment and child-comment queries returning comments of every status, without limiting unapproved comments to moderators and the comment's own author. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view comments that are still waiting for moderation.

References

• https://wpsec.com/vuln/WPSEC-2026-1429/
• https://plugins.svn.wordpress.org/suredash/tags/1.12.3/
• https://wordpress.org/plugins/suredash/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS