Vulnerabilities / SureCart / WPSEC-2026-1139
SureCart <= 4.9.5 - Unauthenticated Open Redirect via Checkout 'success_url' Metadata
Medium 6.1
CWE-601Fixed in 4.9.6
- ID
- WPSEC-2026-1139
- Plugin
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (surecart)
- Affected
- all versions before 4.9.6
- Remediation
- Update to 4.9.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- SureCart on WPSec AttackSurface
- Fix released
- Published
Description
The SureCart plugin for WordPress is vulnerable to Open Redirect via the 'success_url' checkout metadata in all versions up to, and including, 4.9.5, due to insufficient validation of this guest-writable value, which the checkout follows once the order is completed. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites after payment, if they can convince a user to complete a checkout the attacker prepared.
References
- https://wpsec.com/vuln/WPSEC-2026-1139/
- https://plugins.svn.wordpress.org/surecart/tags/4.9.6/
- https://wordpress.org/plugins/surecart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS