CVE-2026-123769

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the save_settings() REST handler at /suredash/v1/save-settings being gated only by admin_permission_callback(), which authorizes any holder of the custom manage_portal_dashboard capability (Portal Manager role) without requiring promote_users, edit_users, or manage_options, combined with sanitize_settings_data() iterating all attacker-supplied keys with no allow-list, allowing arbitrary keys such as default_role to pass through sanitize_text_field() unchanged and be persisted into the portal_settings option via update_option() with no role-validity check.