# SureCart <= 4.9.5 - Unauthenticated Authentication Bypass via Passwordless Login Code Brute Force

- **ID:** WPSEC-2026-1137
- **Plugin:** SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (`surecart`), https://wordpress.org/plugins/surecart/
- **Affected versions:** all versions before 4.9.6
- **Fixed in:** 4.9.6 (Update to 4.9.6 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/surecart
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1137/

## Description

The SureCart plugin for WordPress is vulnerable to Authentication Bypass via the passwordless verification code login REST endpoints (/surecart/v1/verification_codes and /surecart/v1/verification_codes/verify) in all versions up to, and including, 4.9.5, due to the lack of any limit on failed verification attempts and the lack of any restriction on which accounts may log in with a code. This makes it possible for unauthenticated attackers to request a login code for any registered user, including administrators, and brute-force it within its validity window. A correct guess logs the attacker in as that user, which can lead to full site compromise.

## References

- https://wpsec.com/vuln/WPSEC-2026-1137/
- https://plugins.svn.wordpress.org/surecart/tags/4.9.6/
- https://wordpress.org/plugins/surecart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1137/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.