---
id: "CVE-2026-112241"
kind: "vulnerability"
aliases: ["CVE-2026-112241"]
title: "SureCart WordPress plugin: authentication bypass by spoofing up to 4.9.5"
severity: "critical"
cvss: 9.8
epss: 0.00346
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "surecart", "wordpress"]
not_affected_if: ["surecart-not-installed"]
published_at: "2026-10-22T09:17:14+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112241", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112241", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# SureCart WordPress plugin: authentication bypass by spoofing up to 4.9.5

The SureCart WordPress plugin from Brainstorm Force has an authentication bypass flaw in versions through 4.9.5, per the NVD entry. The sources do not say exactly how the spoofing works, but the reported impact is that an attacker can get past authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed SureCart version in the WordPress admin plugin list, or run: wp plugin get surecart --field=version

## Fix

Update SureCart to a version later than 4.9.5. Patched version number: unknown (sources do not say).

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112241
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112241

## From the sources

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_