# SureCart <= 4.9.6 - Unauthenticated Authentication Bypass via Passwordless Login Verification Code

- **ID:** WPSEC-2026-1399
- **Plugin:** SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (`surecart`), https://wordpress.org/plugins/surecart/
- **Affected versions:** from 1.4.0 before 4.10.0
- **Fixed in:** 4.10.0 (Update to 4.10.0 or later.)
- **Severity:** Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/surecart
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1399/

## Description

The SureCart plugin for WordPress is vulnerable to Authentication Bypass via the passwordless login verification code REST endpoints in versions 1.4.0 up to, and including, 4.9.6. This is due to the plugin forwarding all user-supplied query parameters to the upstream verification request that carries the email address of the account being logged into, and logging that account in whenever the upstream service reports a code as verified, without confirming that the verified code belongs to that account's email address. This makes it possible for unauthenticated attackers to complete the login of another user with a code issued to an email address they control, taking over that user's account. In versions before 4.9.6 this includes administrator accounts; 4.9.6 excludes accounts with content-editing or store-management capabilities from code login by default.

## References

- https://wpsec.com/vuln/WPSEC-2026-1399/
- https://plugins.svn.wordpress.org/surecart/tags/4.10.0/
- https://wordpress.org/plugins/surecart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1399/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.