SureCart CVE-2026-97245

Exploitation requires an authenticated WordPress account holding the SureCart 'Shop Worker' role (a limited store-staff role), consistent with the CVSS PR:H metric - it is NOT reachable by anonymous or self-registering visitors. The attacker leverages an operation in SureCart <= 4.7.2 that performs incorrect privilege assignment (CWE-266) to elevate to administrator-level capability. Limiting factors: the vulnerability is gated behind possession of the Shop Worker role and applies to sites running the SureCart plugin at version 4.7.2 or earlier; no user interaction (UI:N) and low complexity (AC:L) are needed once that role is held, making it straightforward for any insider or attacker who compromises a shop-staff credential.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) yields 7.2 (High), and the impact triad C:H/I:H/A:H is consistent with a privilege-escalation flaw (CWE-266, Incorrect Privilege Assignment) where an already-privileged 'Shop Worker' actor gains full administrative control over the site. The decisive limiting signal is PR:H: exploitation is not open to anonymous internet visitors but requires an authenticated account already holding the SureCart 'Shop Worker' role, so the realistic threat model is a rogue, compromised, or over-provisioned shop-staff account rather than mass drive-by exploitation. No EPSS score, KEV listing, POC, or SSVC data was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this reads as a genuine but conditionally-gated escalation issue, not a wormable unauthenticated RCE. The single Patchstack reference is the only corroborating source; affected range (<= 4.7.2) implies a fix in a later release but no patched version is explicitly named in the data, which should be verified against the SureCart changelog.

An attacker who has obtained or been granted a SureCart 'Shop Worker' account (a limited store-staff role) sends an authenticated request that abuses an operation with incorrect privilege assignment, elevating their own account or actions to administrator-level capability. Because scope is unchanged but confidentiality, integrity, and availability impacts are all High, the escalated actor can then take over the WordPress site - installing plugins, editing content, or exfiltrating data. No public proof-of-concept was provided in the source data.