SureCart WordPress Plugin CVE-2026-75793

Exploitation requires that the target WordPress site has user registration explicitly disabled (WordPress Settings → General → 'Anyone can register' unchecked). Sites with open registration are not meaningfully affected since the bypass provides the same access a legitimate self-registration would. The attacker needs network access to the SureCart plugin's account-creation or checkout endpoint; no authentication, existing account, or special headers are required. Limiting factors include: (1) the SSVC Automatable:no assessment suggests SureCart's registration flow may involve steps (e.g., email confirmation, checkout form completion) that add friction against fully automated mass exploitation; (2) the resulting account privilege is limited to subscriber/customer level with no direct privilege escalation path from this CVE alone. Exploitation is constrained to sites that intentionally restricted registration - a deployment configuration, not a default-insecure baseline.

The provided CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly positions this as a medium-severity issue. Network exploitation requires no authentication or user interaction, keeping the attack surface broad. However, the SSVC assessment of Automatable:no suggests some friction in the SureCart registration flow - likely email verification or checkout-step requirements - that limits fully scripted mass account creation. The resulting impact is bounded: an attacker gains subscriber-level (or SureCart customer-level) access, which yields C:L (access to order history, authenticated-only content) and I:L (unauthorized account existence in the user database). There is no direct path to privilege escalation, admin access, or data destruction from this CVE alone, which limits real-world criticality despite the low attack complexity. A publicly available PoC raises urgency for unpatched sites, but SSVC Exploitation:none and no CISA KEV listing indicate no confirmed widespread abuse at time of analysis. Sites with open registration are unaffected in practice (the control being bypassed is already inactive). Priority should be high for sites that explicitly restrict registration and handle sensitive customer PII through SureCart.

An attacker identifies a WordPress site using SureCart where user registration is disabled (confirming the site intends to restrict account access). Using the publicly available PoC, they submit a crafted account-creation request directly to SureCart's endpoint, bypassing the WordPress registration gate. The server responds with a valid authenticated session cookie, granting the attacker logged-in access to the site at subscriber or customer privilege level - potentially exposing order history, PII in the SureCart dashboard, and any content restricted to authenticated users.