EUVD-2026-43148
GHSA-6p8m-qjvm-q2jf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain target's SureCart customer ID
-
DeliverySend crafted webhook sync event
-
ExploitOverwrite linked user email to attacker address
-
ExecutionTrigger WordPress password reset
-
ImpactLog in as administrator
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
| Exploitation Conditions | Exploitation requires that (1) the target WordPress user is linked to a SureCart customer record - administrators are only at risk if their account is linked - and (2) the attacker knows or can guess that user's SureCart customer ID, which is the specific value consumed by the webhook customer-profile-synchronization handler. No authentication is required (PR:N) and no user interaction is needed. What limits exploitation: the customer-ID knowledge requirement (reflected as AC:H), the need for the privileged account to be linked at all, and the fact that the payoff hinges on the follow-on WordPress password-reset flow being available for the hijacked email. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) captures the essentials: fully remote and unauthenticated (PR:N), no user interaction, and total compromise of a targeted account (C:H/I:H/A:H) once achieved. The mitigating signal is AC:H - the attacker must know the target's SureCart customer ID and the target account must actually be linked to a SureCart customer record, so exploitation is not spray-and-pray. No EPSS score, KEV listing, or public POC was provided, so exploitation probability cannot be quantified from the input and should be treated as unknown rather than low. There is no conflict between the vector and the description - both agree on unauthenticated network access with a knowledge precondition. Net: a genuine high-priority issue for sites running SureCart where privileged users are linked to customer records, but the customer-ID prerequisite makes opportunistic mass exploitation less likely than a PR:N score alone would suggest. |
| Exploit ScenarioDerived | An attacker learns or enumerates the SureCart customer ID tied to a site administrator, then sends a crafted webhook event to the plugin's sync endpoint changing that customer's linked email to an attacker-controlled address. With the admin's email now theirs, the attacker requests a WordPress password reset, receives the reset link, and logs in with full administrator privileges. No POC is identified in the provided data, and the attack requires knowing the customer ID (CVSS AC:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.
RemediationAI
Upstream fix available (WordPress plugin trac changeset 3532438); a released patched version is not independently confirmed from the input, though it is expected to be the first release above 4.2.3 (likely 4.2.4) - verify the exact patched version on the plugin's WordPress.org changelog before relying on it. Update SureCart to the fixed release as the primary remediation. As interim compensating controls where immediate patching is not possible: restrict or filter access to the SureCart webhook endpoint at the WAF/reverse-proxy layer so only legitimate SureCart backend IP ranges can reach it (trade-off: may break legitimate webhook delivery if source IPs change), and unlink or avoid linking administrator/editor WordPress accounts to SureCart customer records so a privileged account cannot be targeted via customer ID (trade-off: those admins lose the customer-portal linkage). Enabling a WAF virtual patch such as the Wordfence rule referenced in the advisory can also blunt exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SureCart integrates a hosted commerce backend with WordPress, syncing customer records into local WordPress users via inbound webhook events (customer/order lifecycle callbacks). The vulnerability lives in the webhook handler that updates a linked user's profile fields, notably the email address. The CPE identifies the affected product as cpe:2.3:a:surecart:surecart_-_ecommerce_made_easy_for_selling_physical_products,_digital_downloads,_subscriptions,_donations,_&_payments. The root cause is CWE-640 (Weak Password Recovery Mechanism / insufficient identity validation): the sync routine trusts the customer identifier supplied in the event and mutates the associated WordPress account without authenticating that the caller is authorized to act on that customer, collapsing the normally-separate steps of proving ownership of an email and controlling the account.
Know when Surecart gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and unauthenticated (AV:N/PR:N) but requires knowing the victim's customer ID and a linked account, so AC:H; successful admin takeover yields full C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.
Articles & Coverage 1
Executive ViewAI
The SureCart WordPress plugin (versions ≤ 4.2.3) contains an unauthenticated account takeover vulnerability. While no public exploit is currently identified, attackers knowing a user's customer ID can reset account email addresses during webhook synchronization to seize control, including of administrator accounts. Organizations using this plugin face immediate risk of full site compromise.
Disable webhook functionality if not operationally required; implement IP whitelisting for webhook sources; deploy Web Application Firewall rules to block unauthorized customer profile update requests; disable the SureCart plugin entirely until a vendor patch is available; enable email change notifications for all accounts; enforce multi-factor authentication on WordPress administrator accounts; monitor for unauthorized email changes and anomalous access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) al
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, pe
Unauthenticated information disclosure in the SureCart WordPress plugin before 4.9.5 allows anonymous visitors to pull m
SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to ext
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthentic
Privilege escalation in the SureCart WordPress plugin through version 4.7.2 allows an authenticated user who holds the l
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3)
Stored cross-site scripting in the SureCart WordPress plugin through 4.9.5 lets an authenticated attacker persist malici
Missing authorization controls in SureCart WordPress plugin versions up to 4.0.2 allow authenticated attackers to access
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an aut
Exploit-DB