CVE-2026-120574
Deferred Deferred - Pending Action

Unauthenticated Account Takeover in SureCart WordPress Plugin

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Wordfence

Description
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120574

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated attackers to take over any WordPress user account, including administrators, by exploiting a flawed passwordless login system in the SureCart plugin. The attacker can request a 6-digit verification code for any user via an exposed REST endpoint and brute-force it to gain full access to the account.

Detection Guidance

Check WordPress sites using the SureCart plugin for versions up to 4.9.5. Inspect REST API endpoints for '/verify/' paths with unrestricted access. Monitor failed login attempts or unusual account activity, especially for high-privilege users. Review logs for repeated verification code requests from the same IP addresses.

Impact Analysis

If you use the SureCart plugin up to version 4.9.5, an attacker could gain control of your WordPress site, steal sensitive data, install malware, or deface your website. Even high-privilege accounts like administrators are at risk due to the lack of rate limiting or account lockout mechanisms.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. A breach may result in legal penalties, reputational damage, and loss of trust due to compromised user data.

Mitigation Strategies

Update the SureCart plugin to the latest version immediately. Disable passwordless login features if possible. Implement rate limiting on the '/verify/' endpoint. Block or monitor IP rotation attempts. Review user accounts for unauthorized access and reset credentials for high-privilege users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...