Surecart
Monthly
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.
SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to extract arbitrary database contents via the /surecart/v1/integrations/{id} REST endpoint. The flaw stems from a sanitization bypass in the wp-query-builder component where payloads containing a dot character skip $wpdb->prepare() escaping entirely, enabling UNION-based data exfiltration. No public exploit identified at time of analysis, though Tenable Research has published technical details (TRA-2026-43).
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
Missing authorization controls in SureCart WordPress plugin versions up to 4.0.2 allow authenticated attackers to access or modify restricted data due to incorrectly configured access control security levels. With CVSS 6.3 (authenticated attack, low complexity, confidentiality/integrity/availability impact) and EPSS 0.02% exploitation probability, this represents a moderate-severity flaw affecting plugin deployments where user role separation is security-critical; no public exploit code or active exploitation has been confirmed.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.29.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Account takeover in the SureCart e-commerce plugin for WordPress (versions ≤ 4.2.3) lets unauthenticated attackers overwrite the email address of any WordPress user linked to a SureCart customer record during webhook-driven customer profile synchronization. Because the plugin does not verify the requester's identity before applying the update, an attacker who knows a victim's customer ID - including that of an administrator - can change the account email, trigger a password reset, and seize the account. No public exploit is identified at time of analysis, but the flaw was reported by Wordfence and carries a CVSS of 8.1.
SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to extract arbitrary database contents via the /surecart/v1/integrations/{id} REST endpoint. The flaw stems from a sanitization bypass in the wp-query-builder component where payloads containing a dot character skip $wpdb->prepare() escaping entirely, enabling UNION-based data exfiltration. No public exploit identified at time of analysis, though Tenable Research has published technical details (TRA-2026-43).
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Broken access control in the SureCart WordPress e-commerce plugin through version 4.6.2 permits unauthenticated remote attackers to access protected resources without credentials or user interaction, as confirmed by the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector and CWE-862 (Missing Authorization) classification. The impact is scoped to limited confidentiality exposure (C:L/I:N/A:N), consistent with unauthorized read access to restricted data such as order or customer records rather than write or execution capability. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, though the zero-friction exploitation conditions mean any unpatched internet-facing SureCart installation is trivially reachable.
Missing authorization controls in SureCart WordPress plugin versions up to 4.0.2 allow authenticated attackers to access or modify restricted data due to incorrectly configured access control security levels. With CVSS 6.3 (authenticated attack, low complexity, confidentiality/integrity/availability impact) and EPSS 0.02% exploitation probability, this represents a moderate-severity flaw affecting plugin deployments where user role separation is security-critical; no public exploit code or active exploitation has been confirmed.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SureCart allows Reflected XSS.29.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.