CVE-2026-7655
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The SureCart plugin for WordPress up to version 4.2.3 is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of user identity before updating details like email during customer profile synchronization from webhook events. Unauthenticated attackers can change linked user email addresses, including administrators if their account is linked to a SureCart customer record, and then reset the password to gain access if the customer ID is known.
Risk Assessment
The risk for the organization is the potential takeover of an administrator account by an unauthenticated attacker, leading to full compromise of the WordPress site and customer data.
Recommendation
Immediately update the SureCart plugin to the latest available version that fixes this vulnerability. Also review all user accounts for unauthorized email changes.
Other vulnerabilities in SureCart
See all- CVE-2026-120574High
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route allows an attacker to brute-force a 6-digit code and obtain an authenticated session as any user, including an administrator.
- CVE-2026-112840Medium
The WordPress SureCart plugin through 4.9.5 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This may allow injection of a malicious script that is stored and executed by other users.
- CVE-2026-97245High
The SureCart plugin in versions up to and including 4.7.2 contains a Privilege Escalation vulnerability exploitable by a user with Shop Worker privileges.
- CVE-2026-112241Critical
An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.
- CVE-2026-9065Critical
SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.
- CVE-2026-107653High
The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.9.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g., a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.
- CVE-2026-106599High
The SureCart plugin by Brainstorm Force up to version 4.9.3 contains an untrusted data deserialization vulnerability that allows Object Injection.
- CVE-2026-105874High
The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-109697Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS. This issue affects SureCart: from n/a through 4.9.4.
- CVE-2026-75793Medium
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
Original NVD description (English source)
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS