SureCart CVE-2026-106599

Requires an authenticated session with at least low-privilege access (CVSS PR:L) to a WordPress site running the SureCart plugin version n/a through 4.9.3; on commerce sites that allow customer self-registration, such an account is often obtainable by any visitor. The attacker must reach the SureCart code path that deserializes untrusted input and, for full code execution, a usable PHP gadget chain must exist in the plugin or loaded dependencies. Limiting factors: no unauthenticated access (PR:L, not PR:N), dependence on the specific vulnerable deserialization endpoint, and reliance on an available gadget chain for the highest-impact outcomes; no user interaction is required (UI:N).

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N, indicating a network-reachable, low-complexity attack requiring only low-privilege authentication and no user interaction, with High impact to confidentiality, integrity, and availability - consistent with PHP Object Injection (CWE-502), which commonly escalates to remote code execution when a suitable gadget chain is present. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so exploitation is 'no public exploit identified at time of analysis.' The only intelligence source is a single Patchstack advisory (Patchstack is the CNA/reporter), which is a reliable source for WordPress plugin vulnerabilities but means this is effectively single-sourced. The practical risk is moderated by the PR:L requirement: an attacker must first obtain at least a low-privilege authenticated account (e.g., a subscriber/customer account, which SureCart stores often permit via self-registration on commerce sites) before the object injection is reachable. This is a credible priority for any site running the affected SureCart versions given the H/H/H impact and low complexity, but it is not confirmed as actively exploited; prioritize patching but treat 'widespread active exploitation' claims as unverified. No signals are internally conflicting (CVSS network vector matches the WordPress plugin HTTP attack surface); the main gap is the absence of EPSS/KEV/POC data rather than contradiction.

An attacker with a low-privilege authenticated account on a WordPress site running SureCart ≤ 4.9.3 submits crafted input to a plugin endpoint that deserializes untrusted data, injecting a malicious PHP object. If a usable gadget chain exists in the plugin or a loaded dependency, this can lead to arbitrary file operations or code execution. No public proof-of-concept exploit was identified in the provided data.