CVE-2026-57401— WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability
Possible ATT&CK Techniques 1AI
T1083 · File and Directory DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Brainstorm Force | SureDash | ≤ 1.8.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Brainstorm Force | SureDash | 0 ~ 1.8.0 | - |
II. Public POCs for CVE-2026-57401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57401
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57401 (1)
IV. Related Vulnerabilities
Same vendor: Brainstorm Force
- CVE-2026-54813
WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerabi - CVE-2026-49781
WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vu - CVE-2026-39470
WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1 - CVE-2026-45442
WordPress Presto Player plugin <= 4.1.3 - Broken Access Cont - CVE-2026-42648
WordPress Spectra plugin <= 2.19.22 - Broken Access Control
Same weakness: CWE-22
- CVE-2026-49970
Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePa - CVE-2026-61505
Rejetto HFS < 3.2.1 Limited File Disclosure via Path Travers - CVE-2026-13014
Remote Code Execution vulnerability in "Suspicious" applicat - CVE-2026-57815
WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Dow - CVE-2026-57709
WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbit
V. Comments for CVE-2026-57401
No comments yet