This vulnerability arises from incorrect privilege assignment in the Brainstorm Force SureDash plugin. It allows an attacker to gain elevated privileges within a WordPress installation, potentially giving access to administrative functions and data that should be restricted. The flaw is rooted in improper handling of user capability checks, which can be exploited to change or elevate a user’s role.

Brainstorm Force SureDash version 1.0.3 and earlier are listed as vulnerable in the plugin’s versions.

With a CVSS score of 8.8 and a low EPSS, the risk profile is severe but exploitation is considered unlikely at this time. The flaw is most easily abused by a user who can interact with the plugin’s settings, and the attacker would elevate privileges to gain broader access. This can lead to changes in site configuration, data theft, or further compromise. The lack of a KEV listing means no public evidence of targeted attacks yet, but the high CVSS warrants timely remediation.