Unauthenticated Account Takeover in SureCart Plugin for WordPress
CVE-2026-120574

8.1HIGH

Key Information:

Vendor

WordPress
Status
Surecart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120574?

The SureCart plugin for WordPress enables unauthenticated attackers to take control of any user account, including administrators, due to a vulnerability in its passwordless one-time-code login feature. The REST endpoint responsible for user verification lacks adequate safeguards, allowing attackers to exploit this weakness. They can trigger a code for any user, bypass authentication challenges through IP rotation, and brute-force the login process. With no attempt limits or account lockout mechanisms in place, this poses a significant risk to all WordPress installations using affected versions of the plugin.

Affected Version(s)

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 0 <= 4.9.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/surecart/trunk/app/src/...
https://plugins.svn.wordpress.org/surecart/trunk/app/src/...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hamachi_jp
.