SureCart CVE-2026-32548

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that exploitation requires no authentication, no special configuration, and no victim interaction - any internet-accessible WordPress installation running SureCart version 4.6.2 or earlier is vulnerable in its default installed state. The CWE-862 root cause means the missing authorization check is present in the standard code path, not gated behind an optional feature flag or non-default setting. Exploitation is bounded by the C:L/I:N/A:N impact: attackers gain read access to a limited scope of protected data and cannot write, modify, or delete data, nor achieve code execution through this vulnerability alone. WordPress installations that have globally disabled the REST API via a firewall rule or security plugin (e.g., disabling /wp-json/ entirely) would reduce exposure, but this is not a default WordPress configuration.

The CVSS 5.3 Medium score reflects a significant tension: the attack vector metrics (AV:N/AC:L/PR:N/UI:N) represent worst-case accessibility - fully remote, unauthenticated, no interaction required - while the impact metrics (C:L/I:N/A:N) are constrained and narrow. This is a real, exploitable vulnerability requiring no prerequisites, but the blast radius is limited to confidentiality at a low level. No EPSS data was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing means active exploitation has not been confirmed by CISA, and no POC code was identified in the provided references. The low attack complexity warrants prompt remediation, particularly for SureCart deployments that handle sensitive customer or payment metadata, but the limited impact scope means it is unlikely to serve as a standalone critical-breach vector without chaining to other vulnerabilities.

An unauthenticated attacker discovers a WordPress site running SureCart 4.6.2 or earlier - trivially detectable via plugin enumeration or WordPress meta tags - and sends a crafted HTTP GET request to an unprotected SureCart REST API endpoint. The missing authorization check (CWE-862) allows the request to succeed without credentials, returning restricted data such as order details or customer records. No public exploit code has been identified at time of analysis, but the low complexity and zero authentication barrier make this reproducible by any attacker with basic HTTP tooling.