{
 "id": "WPSEC-2026-1137",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1137/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1137/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1137/index.md",
 "title": "SureCart <= 4.9.5 - Unauthenticated Authentication Bypass via Passwordless Login Code Brute Force",
 "description": "The SureCart plugin for WordPress is vulnerable to Authentication Bypass via the passwordless verification code login REST endpoints (/surecart/v1/verification_codes and /surecart/v1/verification_codes/verify) in all versions up to, and including, 4.9.5, due to the lack of any limit on failed verification attempts and the lack of any restriction on which accounts may log in with a code. This makes it possible for unauthenticated attackers to request a login code for any registered user, including administrators, and brute-force it within its validity window. A correct guess logs the attacker in as that user, which can lead to full site compromise.",
 "plugin": {
  "slug": "surecart",
  "name": "SureCart",
  "full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "wordpress_org": "https://wordpress.org/plugins/surecart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.9.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.9.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.9.6",
 "remediation": "Update to 4.9.6 or later.",
 "fix_released": "2026-10-15T20:46:52+00:00",
 "published": "2026-10-16T21:44:25+00:00",
 "updated": "2026-10-16T10:56:11.168253+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1137/",
  "https://plugins.svn.wordpress.org/surecart/tags/4.9.6/",
  "https://wordpress.org/plugins/surecart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}