Read the docs
TI-2026-06737 Aliases CVE-2026-7655GHSA-6p8m-qjvm-q2jf

SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

Priority LOW 38CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00469 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SureCartSureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Paymentsup to 4.2.3—No fix listedCNA
  • SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments VendorSureCart Affected up to 4.2.3 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7655
  2. 2026-10-03 Alias added: GHSA-6p8m-qjvm-q2jf

References

Other 2

  • TI-2026-84147 Improper authentication in SureCart – Ecommerce Made Easy For Selling Physical Products… CVSS 3.1HIGH 8.1
  • TI-2026-63986 WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability CVSS 3.1HIGH 7.2
  • TI-2026-83482 Stored cross-site scripting in SureCart WordPress plugin CVSS 3.1HIGH 7.2
  • TI-2026-75265 Stored cross-site scripting in SureCart plugin for WordPress CVSS 3.1HIGH 7.2
  • TI-2026-41251 WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-29559 WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences