SureCart CVE-2026-112241

The target must be a WordPress site running the SureCart plugin at version 4.9.5 or earlier. Beyond that, the available sources do not describe the exact feature, configuration, or protocol that must be present to trigger the spoofing-based authentication bypass, so no specific configuration prerequisite can be confirmed - the trigger is not described in the available sources. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required and the attack is network-based, which means the main limiting factor is simply having a vulnerable, reachable installation; there is no stated requirement for a non-default setting, though whether a default install is affected is not confirmed by the input.

Severity signals are strong but the picture is partly inferred. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, consistent with an authentication-bypass-by-spoofing weakness (CWE-290) and the vuln.today 'act_now' decision label. Because the vector contains PR:N, treating this as remotely exploitable by unauthenticated attackers is supported by the data. However, key corroborating signals are MISSING rather than conflicting: no EPSS exploitation-probability score is provided, the vulnerability is NOT listed in CISA KEV, and no SSVC exploitation/automatable/technical-impact breakdown is supplied - so the only elevated-urgency signal is Patchstack's own 'act_now' priority. The single reference is the Patchstack advisory page, not exploit code, so there is no public exploit identified at time of analysis. Net: the CVSS and vendor priority justify prioritized patching, but the absence of EPSS/KEV/SSVC means the real-world exploitation likelihood is unverified and the 9.8 should be read as a severity ceiling pending vendor/Patchstack detail on the exact trigger.

A remote attacker, without any credentials, sends a crafted request to a WordPress site running the SureCart plugin (version 4.9.5 or earlier) that spoofs a trusted authentication artifact, causing the plugin to accept the request as an authenticated identity. This grants the attacker access to functionality that should require authentication (authentication abuse). No public exploit code was identified in the provided data; the only reference is the Patchstack advisory.