Shop Worker Privilege Escalation in SureCart <= 4.7.2

Executive Summary

CVE-2026-97245 is a privilege escalation vulnerability in the WordPress SureCart plugin versions 4.7.2 and earlier. It allows low-privilege users like Shop Workers to gain full administrative control over the website.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the SureCart plugin in your WordPress admin panel. If it is version 4.7.2 or earlier, the system is vulnerable. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin directory for version details.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to take over websites, potentially compromising thousands of sites regardless of size. Users should update to version 4.7.3 or apply provided mitigations immediately.

Useful 0 Not Useful 0

Mitigation Strategies

Update the SureCart plugin to version 4.7.3 or later immediately. If updating is not possible, apply the Patchstack mitigation rule to block attacks until the update is applied. Enable auto-updates for vulnerable plugins if using Patchstack.

Useful 0 Not Useful 0