SureDash plugin versions up to 1.12.3 allow an attacker to delete arbitrary files on the server. The flaw arises from inadequate path validation when handling file deletion requests, enabling removal of any file within the installation. If exploited, an attacker could delete core files, plugins, or content, leading to loss of data, site downtime, or compromise of site integrity.

Affected: Brainstorm Force’s SureDash WordPress plugin. Versions 1.12.3 and earlier are vulnerable. The issue exists in all installations of SureDash where the plugin is active. The patch is available in version 1.12.4 and later.

The CVSS score of 5 reflects moderate risk, with the EPSS score unavailable and no listing in CISA KEV. The likely attack vector is a remote attacker who can submit a request to the vulnerable plugin’s deletion endpoint. Based on the description, it is inferred that a user with subscriber-level access can trigger the deletion, which can then remove arbitrary files from the server. The impact ranges from site instability to complete data loss depending on the deleted files. No special environment prerequisites are noted beyond the plugin’s presence and sufficient permissions.