SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.10.0 - Unauthenticated Sensitive Information Exposure via Login Verification Code Endpoint

ID

WPSEC-2026-1969

Plugin

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (surecart)

Affected

all versions before 4.11.0

Remediation

Update to 4.11.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29

Attack surface

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments on WPSec AttackSurface

Fix released

2026-10-28

Published

2026-10-29

Description

The SureCart plugin for WordPress is vulnerable to Sensitive Information Exposure via the login verification code creation REST endpoint (/surecart/v1/verification_codes) in all versions up to, and including, 4.10.0, due to the endpoint returning the email address of the WordPress account resolved from the submitted username. This makes it possible for unauthenticated attackers to submit a username and obtain the email address of the associated account, including privileged accounts that are not permitted to use code login.

References

• https://wpsec.com/vuln/WPSEC-2026-1969/
• https://plugins.svn.wordpress.org/surecart/tags/4.11.0/
• https://wordpress.org/plugins/surecart/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS