SureDash – Community, Courses & Member Dashboard <= 1.12.3 - Authenticated (Subscriber+) Arbitrary File Deletion via Comment and Feed Post Images
- ID
- WPSEC-2026-1830
- Plugin
- SureDash – Community, Courses & Member Dashboard (suredash)
- Affected
- all versions before 1.12.4
- Remediation
- Update to 1.12.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-73
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- SureDash – Community, Courses & Member Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The SureDash plugin for WordPress is vulnerable to Arbitrary File Deletion via comment and feed post images in all versions up to, and including, 1.12.3, due to the plugin deleting every image file referenced by an <img> src in a deleted comment or feed post if the file lies anywhere in the uploads directory, without checking that the content's author uploaded it. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete image files (gif, png, jpg, jpeg, webp) uploaded by other users or the site. They do this by referencing those files in their own comment and then deleting the comment.
References
- https://wpsec.com/vuln/WPSEC-2026-1830/
- https://plugins.svn.wordpress.org/suredash/tags/1.12.4/
- https://wordpress.org/plugins/suredash/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS