CVE-2026-120574
HighCVSS 8.1Summary
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route allows an attacker to brute-force a 6-digit code and obtain an authenticated session as any user, including an administrator.
Risk Assessment
An unauthenticated attacker can achieve full administrator account takeover, leading to complete site compromise. The lack of attempt limits and lockouts facilitates the attack.
Recommendation
Update the plugin to a version later than 4.9.5. Until updated, consider disabling one-time-code login or implementing external rate-limiting mechanisms.
Other vulnerabilities in SureCart
See all- CVE-2026-112840Medium
The WordPress SureCart plugin through 4.9.5 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This may allow injection of a malicious script that is stored and executed by other users.
- CVE-2026-97245High
The SureCart plugin in versions up to and including 4.7.2 contains a Privilege Escalation vulnerability exploitable by a user with Shop Worker privileges.
- CVE-2026-112241Critical
An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.
- CVE-2026-9065Critical
SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.
- CVE-2026-107653High
The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.
- CVE-2026-106599High
The SureCart plugin by Brainstorm Force up to version 4.9.3 contains an untrusted data deserialization vulnerability that allows Object Injection.
- CVE-2026-105874High
The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-109697Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS. This issue affects SureCart: from n/a through 4.9.4.
- CVE-2026-75793Medium
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
- CVE-2026-32548Medium
Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.
Original NVD description (English source)
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS