Surecart CVE-2026-39488

Exploitation requires a valid WordPress user account (authenticated access, PR:L in CVSS) on the SureCart-enabled site. The vulnerability manifests when access control checks are missing or misconfigured on specific SureCart functions or endpoints, allowing any authenticated user to exercise privileges beyond their assigned role. No special SureCart configuration is required - the flaw exists in the default plugin code; however, exploitation impact depends on which specific operations lack proper authorization (order viewing, customer data access, payment methods, pricing adjustments, or subscription management).

CVSS 6.3 indicates moderate severity with authenticated attack requirement (PR:L), low attack complexity, and confidentiality/integrity/availability impact across a single system (S:U). However, EPSS 0.02% (4th percentile) signals very low real-world exploitation probability, suggesting either limited attacker interest, high exploitation barriers despite low CVSS complexity, or narrow applicability. The missing authorization flaw is a common WordPress plugin weakness, but the combination of low EPSS and lack of public POC/KEV confirmation suggests this is not an actively pursued vector. Real-world risk depends on whether the affected functionality protects sensitive data (customer records, payment info, subscriptions) - if so, even one unauthorized access constitutes material breach risk; if cosmetic or low-value, risk is minimal. Security teams should prioritize based on SureCart's deployment scope and data sensitivity rather than CVSS alone.

A WordPress user with Subscriber or lower role (typical for customers) logs into the site with valid credentials, then directly accesses or modifies a protected endpoint or admin function in SureCart that should be restricted to Site Administrator or Shop Manager roles - for example, viewing other customers' orders, modifying pricing, or accessing payment histories. No technical complexity is required beyond normal WordPress navigation or direct URL/API requests once authenticated.