Account Takeover Vulnerability in SureCart by SureCart
CVE-2026-18480
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18480?
The SureCart WordPress plugin prior to version 4.6.3 contains a critical flaw enabling users with a subscriber-level account to alter another user's email address, including that of an administrator. This vulnerability permits unauthorized account access through password resets. Additionally, it associates attacker-controlled customer records with arbitrary users, exposing customer identifiers and email addresses to any authenticated user, thus facilitating account takeover without elevated privileges.
Affected Version(s)
SureCart 4.0.0 < 4.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.