SureCart CVE-2026-120574

Requires a WordPress site running SureCart ≤4.9.5 with the passwordless one-time-code login flow reachable - the verify() REST route is exposed with a permission callback that returns true, so no authentication or user interaction is needed. The attacker must know or enumerate a target login (e.g., an administrator username/email) and be able to issue high request volumes to brute-force the 6-digit code; the primary limiting factor is the ~1,000,000-value code space and the CDN throttle, which the description says is bypassable via IP rotation. There is no persistent email/IP lockout, no per-account attempt counter, and no role restriction blocking high-privilege logins, so the main practical constraint is the brute-force effort itself (reflected as AC:H), not a special non-default configuration.

This is a credible, high-priority issue rather than a CVSS-inflated one, though the practical bar is non-trivial. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) confirms a network-reachable, unauthenticated flaw - the vulnerable REST route's permission callback returns true, so PR:N is accurate - with high impact to confidentiality, integrity, and availability because success yields an authenticated administrator session (full account takeover). The AC:H is well-grounded in the described mechanism: the attacker must brute-force a 6-digit one-time code (up to ~1,000,000 attempts) and defeat the upstream CDN throttle through IP rotation, so exploitation is achievable but requires volume and effort, not a single request. Exploitation status is 'no public exploit identified at time of analysis' - the references are the Wordfence advisory and the plugin's own vulnerable source files, not a working exploit, and there is no CISA KEV listing. EPSS was not supplied, so exploitation probability cannot be quantified from the input; this is MISSING data, not a low score. The vuln.today 'this_week' decision label and Wordfence attribution align with a serious authentication-bypass that defenders should patch promptly but which is not under confirmed active exploitation. Net: real priority driven by the admin-takeover impact and unauthenticated network reach, tempered by the brute-force/rate-limit-evasion effort reflected in AC:H.

An unauthenticated attacker calls the companion endpoint to trigger a one-time login code for a known administrator account, then repeatedly submits guesses to the VerificationCodeController::verify() REST route, rotating source IPs to evade the bypassable CDN throttle until the correct 6-digit code is accepted. On success the plugin calls $user->login() → wp_set_auth_cookie(), handing the attacker an authenticated administrator session and full control of the WordPress site. No public exploit is identified at time of analysis, but the vulnerable source code is publicly available in the plugin SVN.