Privilege Escalation in SureCart Plugin for WordPress
CVE-2026-7655

8.1HIGH

Key Information:

Vendor

WordPress
Status
Surecart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Vendor
CVE Published:
11 July 2026

What is CVE-2026-7655?

The SureCart plugin for WordPress has a vulnerability that allows unauthorized users to escalate privileges by performing account takeover. This security flaw arises from improper validation of user identities during processes such as email updates in customer profile synchronization via webhook events. As a result, unauthenticated attackers can alter linked users' email addresses, jeopardizing even administrator accounts. If an attacker is aware of a valid customer ID, they can exploit this vulnerability to reset the user's password and gain unauthorized access to their account, making it critical for users to ensure they are using the latest version.

Affected Version(s)

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 0 <= 4.2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3532438/sure...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S. (m3ez)
.