What is the CVSS score of CVE-2026-7655?

CVE-2026-7655 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of SureCart are affected by CVE-2026-7655?

The SureCart WordPress plugin (versions ≤ 4.2.3) contains an unauthenticated account takeover vulnerability.

How to fix or mitigate CVE-2026-7655?

Within 24 hours: Audit all WordPress installations for SureCart plugin usage (versions ≤ 4.2.3) and identify any customer records with administrator account access. Within 7 days: Implement compensating controls including IP whitelisting for webhooks, WAF rules blocking unauthorized customer profile updates, or plugin disablement; enable admin email change notifications. Within 30 days: Deploy continuous monitoring for unauthorized email modifications and anomalous account access; establish subscription to SureCart security advisories for patch availability.

SureCart CVE-2026-7655

EUVD-2026-43148 HIGH

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-07-11 Wordfence

GHSA-6p8m-qjvm-q2jf

WordPress Privilege Escalation Surecart Wordpress Plugin Surecart Ecommerce Made Easy For Selling Physical Products Digital Downloads Subscriptions Donations Payments

8.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote and unauthenticated (AV:N/PR:N) but requires knowing the victim's customer ID and a linked account, so AC:H; successful admin takeover yields full C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:21 vuln.today

CVE Published

Jul 11, 2026 - 04:32 cve.org

HIGH 8.1

DescriptionCVE.org

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.

Technical ContextAI

SureCart integrates a hosted commerce backend with WordPress, syncing customer records into local WordPress users via inbound webhook events (customer/order lifecycle callbacks). The vulnerability lives in the webhook handler that updates a linked user's profile fields, notably the email address. The CPE identifies the affected product as cpe:2.3:a:surecart:surecart_-_ecommerce_made_easy_for_selling_physical_products,_digital_downloads,_subscriptions,_donations,_&_payments. The root cause is CWE-640 (Weak Password Recovery Mechanism / insufficient identity validation): the sync routine trusts the customer identifier supplied in the event and mutates the associated WordPress account without authenticating that the caller is authorized to act on that customer, collapsing the normally-separate steps of proving ownership of an email and controlling the account.

RemediationAI

Upstream fix available (WordPress plugin trac changeset 3532438); a released patched version is not independently confirmed from the input, though it is expected to be the first release above 4.2.3 (likely 4.2.4) - verify the exact patched version on the plugin's WordPress.org changelog before relying on it. Update SureCart to the fixed release as the primary remediation. As interim compensating controls where immediate patching is not possible: restrict or filter access to the SureCart webhook endpoint at the WAF/reverse-proxy layer so only legitimate SureCart backend IP ranges can reach it (trade-off: may break legitimate webhook delivery if source IPs change), and unlink or avoid linking administrator/editor WordPress accounts to SureCart customer records so a privileged account cannot be targeted via customer ID (trade-off: those admins lose the customer-portal linkage). Enabling a WAF virtual patch such as the Wordfence rule referenced in the advisory can also blunt exploitation attempts.