Privilege Escalation via Account Takeover in SureCart WordPress Plugin

Executive Summary

The SureCart plugin for WordPress has a vulnerability that allows privilege escalation through account takeover in versions up to and including 4.2.3. This happens because the plugin does not properly verify a user's identity before updating their details, such as email addresses, during customer profile synchronization triggered by webhook events.

As a result, an unauthenticated attacker who knows a customer ID can change the linked user's email address, including those of administrators if their account is linked to a SureCart customer record. The attacker can then reset the user's password and gain access to their account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows attackers to escalate privileges by taking over user accounts without authentication.

• Attackers can change email addresses of users, including administrators.
• Attackers can reset passwords and gain unauthorized access to user accounts.
• Compromise of administrator accounts can lead to full control over the WordPress site.
• This can result in data breaches, unauthorized changes, and potential disruption of services.

Useful 0 Not Useful 0