{
 "id": "WPSEC-2026-1139",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1139/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1139/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1139/index.md",
 "title": "SureCart <= 4.9.5 - Unauthenticated Open Redirect via Checkout 'success_url' Metadata",
 "description": "The SureCart plugin for WordPress is vulnerable to Open Redirect via the 'success_url' checkout metadata in all versions up to, and including, 4.9.5, due to insufficient validation of this guest-writable value, which the checkout follows once the order is completed. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites after payment, if they can convince a user to complete a checkout the attacker prepared.",
 "plugin": {
  "slug": "surecart",
  "name": "SureCart",
  "full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "wordpress_org": "https://wordpress.org/plugins/surecart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
 },
 "type": "REDIRECT",
 "cwe": [
  "CWE-601"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.9.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.9.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.9.6",
 "remediation": "Update to 4.9.6 or later.",
 "fix_released": "2026-10-15T20:46:52+00:00",
 "published": "2026-10-16T21:44:25+00:00",
 "updated": "2026-10-16T10:56:11.168253+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1139/",
  "https://plugins.svn.wordpress.org/surecart/tags/4.9.6/",
  "https://wordpress.org/plugins/surecart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-16"
 }
}