{"id":"CVE-2026-112241","kind":"vulnerability","aliases":["CVE-2026-112241"],"related":[],"title":"SureCart WordPress plugin: authentication bypass by spoofing up to 4.9.5","description":"Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.","summary":"The SureCart WordPress plugin from Brainstorm Force has an authentication bypass flaw in versions through 4.9.5, per the NVD entry. The sources do not say exactly how the spoofing works, but the reported impact is that an attacker can get past authentication.","severity":"critical","cvss":9.8,"epss":0.00346,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","surecart","wordpress"],"not_affected_if":["surecart-not-installed"],"how_to_check":"Check the installed SureCart version in the WordPress admin plugin list, or run: wp plugin get surecart --field=version","fix":"Update SureCart to a version later than 4.9.5. Patched version number: unknown (sources do not say).","status":"open","published_at":"2026-10-22T09:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:34+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T22:32:34Z","model":"claude-haiku-5-5","output":{"fix":"Update SureCart to a version later than 4.9.5. Patched version number: unknown (sources do not say).","reach":"internet","title":"SureCart WordPress plugin: authentication bypass by spoofing up to 4.9.5","impact":"high","summary":"The SureCart WordPress plugin from Brainstorm Force has an authentication bypass flaw in versions through 4.9.5, per the NVD entry. The sources do not say exactly how the spoofing works, but the reported impact is that an attacker can get past authentication.","category":"package","who_cares":["wordpress","surecart","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker bypasses login and acts as another user on the site","analyst_note":"Check the NVD entry and the vendor's changelog for the patched version and the exact spoofing mechanism, and whether the bypass needs an account.","how_to_check":"Check the installed SureCart version in the WordPress admin plugin list, or run: wp plugin get surecart --field=version","needs_analyst":true,"not_affected_if":["surecart-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000502,"input_tokens":2899,"output_tokens":424,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112241':13A,16A '-2026':12A,15A '4.9.5':10A,38B,84C 'abuse.this':77C 'affect':79C 'allow':75C 'attack':60B 'authent':4A,32B,64B,65C,76C 'brainstorm':28B,71C 'bypass':5A,33B,66C 'cve':11A,14A 'entri':42B 'exact':48B 'flaw':34B 'forc':29B,72C 'get':62B 'host':20B 'impact':56B 'issu':78C 'n/a':82C 'nvd':41B 'packag':17B 'past':63B 'per':39B 'plugin':3A,26B 'report':55B 'say':47B 'self':19B 'self-host':18B 'sourc':44B 'spoof':7A,51B,68C 'surecart':1A,21B,24B,73C,74C,80C 'version':36B 'vulner':69C 'wordpress':2A,22B,25B 'work':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112241","severity":null,"published_at":"2026-10-22T09:17:14+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112241","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112241","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}