# SureCart <= 4.9.5 - Unauthenticated Open Redirect via Checkout 'success_url' Metadata

- **ID:** WPSEC-2026-1139
- **Plugin:** SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (`surecart`), https://wordpress.org/plugins/surecart/
- **Affected versions:** all versions before 4.9.6
- **Fixed in:** 4.9.6 (Update to 4.9.6 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-601
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/surecart
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1139/

## Description

The SureCart plugin for WordPress is vulnerable to Open Redirect via the 'success_url' checkout metadata in all versions up to, and including, 4.9.5, due to insufficient validation of this guest-writable value, which the checkout follows once the order is completed. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites after payment, if they can convince a user to complete a checkout the attacker prepared.

## References

- https://wpsec.com/vuln/WPSEC-2026-1139/
- https://plugins.svn.wordpress.org/surecart/tags/4.9.6/
- https://wordpress.org/plugins/surecart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1139/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.