SureCart <= 4.9.5 - Unauthenticated Authentication Bypass via Passwordless Login Code Brute Force
- ID
- WPSEC-2026-1137
- Plugin
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (surecart)
- Affected
- all versions before 4.9.6
- Remediation
- Update to 4.9.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- SureCart on WPSec AttackSurface
- Fix released
- Published
Description
The SureCart plugin for WordPress is vulnerable to Authentication Bypass via the passwordless verification code login REST endpoints (/surecart/v1/verification_codes and /surecart/v1/verification_codes/verify) in all versions up to, and including, 4.9.5, due to the lack of any limit on failed verification attempts and the lack of any restriction on which accounts may log in with a code. This makes it possible for unauthenticated attackers to request a login code for any registered user, including administrators, and brute-force it within its validity window. A correct guess logs the attacker in as that user, which can lead to full site compromise.
References
- https://wpsec.com/vuln/WPSEC-2026-1137/
- https://plugins.svn.wordpress.org/surecart/tags/4.9.6/
- https://wordpress.org/plugins/surecart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS