---
id: "CVE-2026-120574"
kind: "vulnerability"
aliases: ["CVE-2026-120574"]
title: "SureCart WordPress plugin: unauthenticated login lets attackers take over admin accounts"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "surecart", "fixed": ["4.9.6"], "affected": "<= 4.9.5", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "surecart", "wordpress"]
not_affected_if: ["surecart-not-installed"]
published_at: "2026-11-03T05:18:33+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:51:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120574", "first_seen_at": "2026-11-03T05:48:53+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T05:51:04+00:00"}]
---

# SureCart WordPress plugin: unauthenticated login lets attackers take over admin accounts

The SureCart plugin for WordPress has a passwordless login route with no brute-force protection on its 6-digit code. An unauthenticated attacker can guess the code and get a logged-in session as any user, including an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:surecart affected <= 4.9.5 fixed 4.9.6

## How to check

WordPress admin > Plugins: SureCart version must be 4.9.6 or higher, ideally 4.11.0+. Or read the Version header in wp-content/plugins/surecart/surecart.php. Sites with the passwordless/access-code login enabled (introduced around 4.4.0) are the exposed path; also review admin accounts and recent logins for unexpected sessions.

## Fix

Update SureCart to 4.9.6 or later (Wordfence); the vendor's changelog shows further login-code hardening in 4.10.0 and 4.11.0, so move to the latest release (4.11.0 or newer).

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120574
- 2026-11-03T05:51:04+00:00 analyst — Wordfence advisory: affected <= 4.9.5, patched 4.9.6. SureCart changelog lists 4.9.6 (Oct 16) 'passwordless login codes strengthened (props Wordfence)'; vendor does not name the CVE. WPSec lists a separate auth-bypass fixed in 4.10.0 and login-code hardening in 4.11.0 (rate-limited emails), so recommend latest (>= 4.11.0). No exploitation or PoC found. Not marked verified: fix version comes from Wordfence, not the vendor's own text.

## Documents

- [advisory] Wordfence: SureCart <= 4.9.5 Unauthenticated Account Takeover https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/surecart/surecart-ecommerce-made-easy-for-selling-physical-products-digital-downloads-subscriptions-donations-payments-495-unauthenticated-account-takeover
- [fix] SureCart changelog (4.9.6, 4.10.0, 4.11.0) https://surecart.com/whats-new/
- [mentions] WPSec: SureCart vulnerability list https://wpsec.com/vuln/plugin/surecart/

## From the sources

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_