What is the CVSS score of CVE-2026-32548?

CVE-2026-32548 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

SureCart CVE-2026-32548

EUVD-2026-53955 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-qc8j-58hh-5x43

WordPress Authentication Bypass Surecart Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with no interaction needed (AV:N, AC:L, PR:N, UI:N); impact limited to low confidentiality read with no integrity or availability effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:01 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

AnalysisAI

Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.

Technical ContextAI

SureCart (CPE: cpe:2.3:a:surecart:surecart) is a WordPress e-commerce plugin providing checkout, order management, and subscription functionality as an alternative to WooCommerce. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes one or more endpoints - most likely REST API routes or WordPress AJAX handlers - without implementing proper authorization checks such as WordPress capability checks via current_user_can(). In the WordPress plugin ecosystem, this pattern arises when developers register endpoints with public visibility (e.g., permission_callback returning __return_true or being omitted) or fail to gate sensitive actions behind nonce verification and role validation. The CVSS confidentiality-only impact at the Low level suggests unauthorized read access to scoped data rather than full database or filesystem exposure.

RemediationAI

Update SureCart to a version newer than 4.6.2 via the WordPress plugin dashboard or WordPress CLI (wp plugin update surecart). The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/surecart/vulnerability/wordpress-surecart-plugin-4-6-2-broken-access-control-vulnerability should be reviewed to confirm the exact fixed release version, as the current intelligence does not specify a patched version number - the patch is described as available per vendor reporting but a precise target version was not confirmed. If immediate upgrade is not feasible, a compensating control is to restrict access to SureCart REST API namespace endpoints (typically prefixed with /wp-json/surecart/) at the web server or WAF layer, limiting requests to authenticated sessions or known IP ranges. Note that blocking REST API access may disrupt front-end checkout flows or SureCart SaaS synchronization features, so scope any IP restriction carefully to avoid customer-facing impact.