SureCart Plugin CVE-2026-18480

Exploitation requires a subscriber-level WordPress account on the target site (PR:L). If open user registration is enabled - common on e-commerce storefronts using SureCart - any anonymous internet user can self-register to reach this threshold. The SureCart plugin must be installed, active, and running versions 4.0.0 through 4.6.2. No special site configuration beyond running a vulnerable SureCart version is required; the IDOR and disclosure flaws are present in default plugin operation. Exploitation is not limited by network position (AV:N) or complexity (AC:L). What limits exploitation: the attacker must hold at minimum a subscriber account, meaning sites that disable all user registration or restrict account creation to trusted parties substantially reduce exposure.

The CVSS 8.8 rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability: network reachable, low complexity, and requiring only subscriber-level access, the full attack chain results in complete administrator account compromise. The decisive risk amplifier is the paired information disclosure - without it, an attacker would need to guess or bruteforce customer IDs, but the disclosure endpoint removes that barrier entirely. With a publicly available PoC from WPScan, exploitation is easily scripted; even a mid-sized e-commerce operator in gniezno should treat this as urgent given that subscriber registration is often open on WooCommerce/SureCart storefronts. No KEV listing is noted at time of analysis, but the low barrier (one subscriber account + PoC) makes broad opportunistic exploitation likely. The A:H in the CVSS vector reflects that admin account takeover effectively disables the site's administrative capability. EPSS data is not present in the source intelligence, but PoC availability and low privilege requirement suggest elevated real-world exploitation probability.

An attacker registers a free subscriber account on a target WordPress/SureCart storefront, then queries the information disclosure endpoint to retrieve the administrator's SureCart customer ID and current email address. The attacker submits a crafted API request - substituting the admin's customer ID as the target - changing the administrator's registered email to an attacker-controlled address, then triggers a standard WordPress password reset to the new address, completing a full admin account takeover with no victim interaction required. A publicly available PoC from WPScan documents this exact chain.