This vulnerability is a missing authorization flaw in the WordPress SureDash plugin that permits attackers to bypass intended access controls. By exploiting an insecure configuration of access‑control security levels, a remote or authenticated user with limited privileges could perform actions reserved for administrators, potentially manipulating the plugin’s data and affecting the wider WordPress site.

The issue impacts the Brainstorm Force SureDash plugin for WordPress, affecting all releases up to and including version 1.12.2. Users running any earlier versions lack the protection introduced in 1.12.3.

The CVSS score of 6.5 indicates a moderate severity. No EPSS data is available, so the likelihood of exploitation cannot be quantified, but the flaw is not listed in the CISA KEV catalog. The attack can be carried out over the web by submitting specially crafted requests to the plugin’s endpoints, making it exploitable by unauthenticated or low‑privileged attackers.