{
 "id": "WPSEC-2026-1969",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1969/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1969/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1969/index.md",
 "title": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.10.0 - Unauthenticated Sensitive Information Exposure via Login Verification Code Endpoint",
 "description": "The SureCart plugin for WordPress is vulnerable to Sensitive Information Exposure via the login verification code creation REST endpoint (/surecart/v1/verification_codes) in all versions up to, and including, 4.10.0, due to the endpoint returning the email address of the WordPress account resolved from the submitted username. This makes it possible for unauthenticated attackers to submit a username and obtain the email address of the associated account, including privileged accounts that are not permitted to use code login.",
 "plugin": {
  "slug": "surecart",
  "name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "wordpress_org": "https://wordpress.org/plugins/surecart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.11.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.11.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.11.0",
 "remediation": "Update to 4.11.0 or later.",
 "fix_released": "2026-10-28T19:13:57+00:00",
 "published": "2026-10-29T19:43:39+00:00",
 "updated": "2026-10-29T17:43:04.836078+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1969/",
  "https://plugins.svn.wordpress.org/surecart/tags/4.11.0/",
  "https://wordpress.org/plugins/surecart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}