{"id":"CVE-2026-120574","kind":"vulnerability","aliases":["CVE-2026-120574"],"related":[],"title":"SureCart WordPress plugin: unauthenticated login lets attackers take over admin accounts","description":"The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.","summary":"The SureCart plugin for WordPress has a passwordless login route with no brute-force protection on its 6-digit code. An unauthenticated attacker can guess the code and get a logged-in session as any user, including an administrator.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"surecart","fixed":["4.9.6"],"affected":"<= 4.9.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","surecart","wordpress"],"not_affected_if":["surecart-not-installed"],"how_to_check":"WordPress admin > Plugins: SureCart version must be 4.9.6 or higher, ideally 4.11.0+. Or read the Version header in wp-content/plugins/surecart/surecart.php. Sites with the passwordless/access-code login enabled (introduced around 4.4.0) are the exposed path; also review admin accounts and recent logins for unexpected sessions.","fix":"Update SureCart to 4.9.6 or later (Wordfence); the vendor's changelog shows further login-code hardening in 4.10.0 and 4.11.0, so move to the latest release (4.11.0 or newer).","status":"open","published_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:46+00:00","updated_at":"2026-11-03T05:51:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T05:49:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SureCart WordPress plugin: unauthenticated login lets attackers take over admin accounts","impact":"high","summary":"The SureCart plugin for WordPress has a passwordless login route with no brute-force protection on its 6-digit code. An unauthenticated attacker can guess the code and get a logged-in session as any user, including an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","surecart","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker gets administrator session and full site control","analyst_note":"Confirm the fixed SureCart version after 4.9.5 and whether the vendor has published a patch, using the NVD entry and the plugin's changelog.","how_to_check":"- Check whether the SureCart plugin is installed and its version is `4.9.5` or lower (WordPress admin > Plugins, or the plugin header in `wp-content/plugins/surecart/`)\n- Look for the REST route `VerificationCodeController` or its verification endpoint in the plugin code","plain_action":"","needs_analyst":true,"not_affected_if":["surecart-not-installed"],"who_is_affected":"Sites running the SureCart plugin for WordPress at version 4.9.5 or earlier are exposed, because its one-time-code login route is reachable without an account and has no attempt limit. Sites without SureCart installed, or running a version newer than 4.9.5 once a fix is confirmed, are not affected by this description. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4334,"output_tokens":587,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed SureCart version after 4.9.5 and whether the vendor has published a patch, using the NVD entry and the plugin's changelog.","search":"'-120574':14A,17A '-2026':13A,16A '4.9.5':84C '6':43B,113C,198C 'account':11A,75C,142C,168C,214C 'admin':10A 'administr':65B,187C,213C 'affect':134C 'attack':7A,48B,104C,177C 'attacker-suppli':103C 'attempt':143C 'auth':124C 'authent':204C 'brute':38B,195C 'brute-forc':37B,194C 'bypass':157C 'call':119C 'callback':98C 'cdn':154C 'code':45B,52B,90C,115C,181C,200C 'companion':190C 'cooki':125C 'counter':144C 'cve':12A,15A 'digit':44B,114C,199C 'email/ip':147C 'endpoint':192C 'forc':39B,196C 'full':212C 'get':54B 'guess':50B 'high':166C 'high-privileg':165C 'host':22B 'includ':63B,83C,185C 'ip':159C 'let':6A 'limit':151C 'lockout':148C 'log':57B,171C 'logged-in':56B 'login':5A,33B,91C,106C,121C 'obtain':202C 'one':88C 'one-time-cod':87C 'packag':19B 'passwordless':32B,86C 'path':137C 'per':141C 'per-account':140C 'permiss':97C 'persist':146C 'plugin':3A,27B,68C 'prevent':164C 'privileg':167C 'protect':40B 'rate':150C 'resolv':101C 'rest':92C 'restrict':163C 'result':209C 'return':99C 'role':131C 'rotat':160C 'rout':34B,93C 'self':21B 'self-host':20B 'session':59B,205C 'set':123C 'success':118C 'suppli':105C 'surecart':1A,18A,23B,26B,67C 'take':8A 'takeov':76C,215C 'throttl':155C 'time':89C 'trigger':179C 'true':100C 'unauthent':4A,47B,74C,176C,191C 'upstream':153C 'user':62B,110C,120C,128C,184C,208C 'verifi':95C,111C 'verificationcodecontrol':94C 'version':79C,135C 'via':158C,188C 'vulner':72C 'whose':96C 'wordpress':2A,24B,29B,70C,109C 'wp':122C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the SureCart plugin at version 4.9.5 or lower. An unauthenticated attacker can request a login code for any user, including an administrator, and brute-force the 6-digit code through the REST route to get a logged-in session. Sites on 4.9.6 or later, or without SureCart, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["surecart"],"ptokens":["surecart"],"labels":["high","package","selfhosted","surecart","wordpress"],"first_public_at":"2026-11-03T05:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120574","severity":null,"published_at":"2026-11-03T05:18:33+00:00","modified_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120574:1455","url":null,"severity":null,"published_at":"2026-11-03T05:51:04+00:00","modified_at":"2026-11-03T05:51:04+00:00","first_seen_at":"2026-11-03T05:51:04+00:00","fetched_at":"2026-11-03T05:51:04+00:00","note":"Wordfence advisory: affected <= 4.9.5, patched 4.9.6. SureCart changelog lists 4.9.6 (Oct 16) 'passwordless login codes strengthened (props Wordfence)'; vendor does not name the CVE. WPSec lists a separate auth-bypass fixed in 4.10.0 and login-code hardening in 4.11.0 (rate-limited emails), so recommend latest (>= 4.11.0). No exploitation or PoC found. Not marked verified: fix version comes from Wordfence, not the vendor's own text."}],"documents":[{"id":55852,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/surecart/surecart-ecommerce-made-easy-for-selling-physical-products-digital-downloads-subscriptions-donations-payments-495-unauthenticated-account-takeover","title":"Wordfence: SureCart <= 4.9.5 Unauthenticated Account Takeover","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":55853,"url":"https://surecart.com/whats-new/","title":"SureCart changelog (4.9.6, 4.10.0, 4.11.0)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":55854,"url":"https://wpsec.com/vuln/plugin/surecart/","title":"WPSec: SureCart vulnerability list","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}