CVE-2026-106599

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route allows an attacker to brute-force a 6-digit code and obtain an authenticated session as any user, including an administrator.

The WordPress SureCart plugin through 4.9.5 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This may allow injection of a malicious script that is stored and executed by other users.

The SureCart plugin in versions up to and including 4.7.2 contains a Privilege Escalation vulnerability exploitable by a user with Shop Worker privileges.

An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.

SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.

The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS. This issue affects SureCart: from n/a through 4.9.4.

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.