---
id: CVE-2026-120574
title: >-
  SureCart – Ecommerce Made Easy For Selling Physical Products, Digital
  Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated
  Account Takeover
summary: >-
  The SureCart plugin for WordPress is vulnerable to unauthenticated account
  takeover in all versions up to, and including, 4.9.5. The passwordless
  one-time-code login REST route (VerificationCodeController::verify(), whose
  permission call…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-287
vendor: surecart
product: >-
  SureCart – Ecommerce Made Easy For Selling Physical Products, Digital
  Downloads, Subscriptions, Donations, & Payments
affected:
  - >-
    ecommerce_made_easy_for_selling_physical_products_digital_downloads_subscriptions_donations_payments
    <= 4.9.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T18:59:53.750539Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:00:08.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120574'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/dffdcaa2-5100-48f5-9b82-e22075fd87e5?source=cve
  - url: >-
      https://plugins.svn.wordpress.org/surecart/trunk/app/src/Controllers/Rest/VerificationCodeController.php
  - url: >-
      https://plugins.svn.wordpress.org/surecart/trunk/app/src/Rest/VerificationCodeRestServiceProvider.php
  - url: 'https://plugins.svn.wordpress.org/surecart/trunk/app/src/Models/User.php'
  - url: 'https://wordpress.org/plugins/surecart/#developers'
tags:
  - cve.org
epss: 0.00331
epssPercentile: 0.26381
ingestedAt: '2026-11-05T20:33:06.374Z'
---

## Overview

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

## Affected

- `ecommerce_made_easy_for_selling_physical_products_digital_downloads_subscriptions_donations_payments <= 4.9.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.