PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110894 Brainstorm Force CVE debrief

The CVE-2026-110894 vulnerability affects the WordPress SureDash plugin, versions up to and including 1.12.2, due to a missing authorization issue, allowing unauthorized access. This issue has been publicly disclosed and is associated with a CVSS score of 5.3, indicating a medium severity level. The vulnerability is a Broken Access Control issue, potentially leading to information disclosure. Defenders should verify the plugin version, review access controls, and monitor for unusual activity. The CVE record and source item provide details on the vulnerability, including its description as a missing authorization issue in the SureDash plugin, affecting versions from n/a through 1.12

Vendor
Brainstorm Force
Product
SureDash
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders and administrators of WordPress sites using the SureDash plugin should be aware of this vulnerability. They should verify the version of the plugin in use and ensure it is updated. Additionally, reviewing access controls and monitoring for unusual activity is recommended.

Why it matters

CVE-2026-110894 is a medium-severity vulnerability in the WordPress SureDash plugin, allowing unauthorized access due to a missing authorization issue. Defenders should verify the plugin version, review access controls, and monitor for unusual activity.

  • Verification of plugin version and potential update to a secure version is required.
  • Review of access controls and configurations for the SureDash plugin is necessary.
  • Monitoring for unusual activity or unauthorized access attempts on the WordPress site is advised.

Technical summary

The WordPress SureDash plugin, versions up to and including 1.12.2, is vulnerable to a missing authorization issue. This allows unauthorized access, potentially leading to information disclosure. The vulnerability is described as a Broken Access Control issue and has been assigned a CVSS score of 5.3, indicating medium severity.

Defensive priority

Defenders should prioritize verifying the version of the SureDash plugin in use and ensuring it is updated to a version beyond 1.12.2 if possible, alongside reviewing access controls and monitoring for unusual activity.

Recommended defensive actions

  • Verify the version of the SureDash plugin in use and update to a version beyond 1.12.2 if possible.
  • Review access controls and configurations for the SureDash plugin.
  • Monitor for unusual activity or unauthorized access attempts on the WordPress site.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description as a missing authorization issue in the SureDash plugin, affecting versions from n/a through 1.12.2. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110894 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110894

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110894 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110894

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.