{
 "id": "WPSEC-2026-1399",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1399/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1399/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1399/index.md",
 "title": "SureCart <= 4.9.6 - Unauthenticated Authentication Bypass via Passwordless Login Verification Code",
 "description": "The SureCart plugin for WordPress is vulnerable to Authentication Bypass via the passwordless login verification code REST endpoints in versions 1.4.0 up to, and including, 4.9.6. This is due to the plugin forwarding all user-supplied query parameters to the upstream verification request that carries the email address of the account being logged into, and logging that account in whenever the upstream service reports a code as verified, without confirming that the verified code belongs to that account's email address. This makes it possible for unauthenticated attackers to complete the login of another user with a code issued to an email address they control, taking over that user's account. In versions before 4.9.6 this includes administrator accounts; 4.9.6 excludes accounts with content-editing or store-management capabilities from code login by default.",
 "plugin": {
  "slug": "surecart",
  "name": "SureCart",
  "full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "wordpress_org": "https://wordpress.org/plugins/surecart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 9.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Critical"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.4.0",
    "from_inclusive": true,
    "to": "4.10.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.4.0 before 4.10.0"
  ]
 },
 "introduced_in": "1.4.0",
 "fixed_in": "4.10.0",
 "remediation": "Update to 4.10.0 or later.",
 "fix_released": "2026-10-20T19:00:25+00:00",
 "published": "2026-10-21T19:42:05+00:00",
 "updated": "2026-10-21T12:33:40.961511+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1399/",
  "https://plugins.svn.wordpress.org/surecart/tags/4.10.0/",
  "https://wordpress.org/plugins/surecart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}