The vulnerability is a missing authorization flaw in the SureDash plugin for WordPress, allowing an attacker to bypass the intended access control checks and access restricted functionality. The issue is classified as a CWE‑862 (Missing Authorization). This flaw can grant an attacker the ability to view or manipulate data that should be protected, which could compromise confidentiality and integrity of the site content.

Affected users are WordPress site administrators running the Brainstorm Force SureDash plugin versions up through 1.12.2. The plugin applies to any WordPress installation where SureDash is installed. The exact version range affected is from the initial release up to and including 1.12.2.

The severity is moderate with a CVSS score of 5.3. No EPSS score is publicly available, indicating the exploitation probability is not well defined in the public data. The vulnerability is not listed in the CISA KEV catalog, and no publicly known exploit has been documented. The likely attack path involves an authenticated user or a user who can manipulate the request to trigger the access control logic, but the vulnerability is generally classified as an access control issue, implying that an attacker with sufficient privileges could leverage it to elevate access. Since no exploit is confirmed, the risk is primarily theoretical, but the moderate score reflects potential for significant impact if exploited. The remediation is straightforward with a plugin update.