CVE-2026-54813: WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability

Synopsis

A SQL injection vulnerability in the WordPress SureDash plugin (versions up to and including 1.8.0) allows a network-accessible attacker with a low-privilege account to send maliciously crafted database queries to the affected WordPress installation. The vulnerability is of the blind SQL injection variety, meaning the attacker extracts data by observing application behavior rather than direct output. Successful exploitation reads data from the underlying database and causes minor service disruption, with scope extending beyond the plugin itself to other components sharing the database. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege WordPress account (such as a subscriber-level user) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted requests directly to the application.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental factors beyond network access and a valid low-privilege account.

Blast Radius

• Reads data from the WordPress database beyond the plugin's own tables, including user credentials, session tokens, and site configuration stored by other plugins or WordPress core.
• Extracts data through blind timing or boolean inference, which is slower but fully effective against all database content the database user can reach.
• Causes minor, intermittent availability disruption to the affected WordPress installation as crafted queries increase database load.
• Scope extends beyond SureDash itself: because the CVSS scope token is Changed, other components sharing the same database or application context are reachable.