The SureDash plugin contains a missing authorization flaw that allows attackers to bypass proper permission checks. By exploiting this weakness, an attacker could gain elevated privileges or access restricted features within the WordPress site. The issue is classified as CWE‑862, indicating an access control vulnerability that can lead to unauthorized actions.

All releases of the Brainstorm Force SureDash plugin for WordPress up to and including version 1.12.2 are affected. WordPress sites that have these plugin versions installed are vulnerable. The flaw is fixed in version 1.12.3 and later, which implements correct authorization checks for plugin features.

The CVSS score of 5.3 denotes moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit this flaw by creating or modifying roles with elevated permissions, or by re‑using existing credentials that have been granted misconfigured plugin permissions. The likely attack vector is the WordPress administrative interface or any interface exposed by the plugin to users with altered privileges. The absence of proper authorization checks makes remediation possible by upgrading to the patched version.