CVE-2026-120574 in SureCart Plugin
Summary
by MITRE • 11/03/2026
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The SureCart plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 4.9.5. This flaw resides within the passwordless one-time-code login REST route, specifically implemented in the VerificationCodeController::verify method. The core technical deficiency is that the permission callback associated with this endpoint unconditionally returns true, thereby allowing any user, regardless of authentication status or privilege level, to access the functionality designed for legitimate account recovery and login processes. This architectural oversight effectively removes the fundamental gatekeeping mechanism required to secure sensitive identity verification operations within a web application context.
The operational mechanics of the vulnerability involve an attacker supplying a target username via an unauthenticated companion endpoint to trigger the delivery of a six-digit one-time code. Once the code is issued, the system proceeds to verify this input against the stored value for that specific user account. Upon successful verification, the system invokes standard WordPress authentication functions, specifically $user->login() followed by wp_set_auth_cookie(), which establishes a persistent authenticated session for the targeted user. Crucially, there are no restrictions preventing high-privilege accounts, such as administrators, from being logged in through this path. This means an attacker can target any existing account on the WordPress installation and assume its identity without possessing valid credentials or completing multi-factor authentication challenges intended to protect privileged access.
The severity of this vulnerability is significantly amplified by the complete absence of rate limiting and brute-force protection mechanisms at both the application level and effectively within the network perimeter controls often relied upon for defense in depth. There is no per-account attempt counter implemented to limit the number of verification code guesses allowed, nor are there persistent lockouts based on email address or IP address thresholds. While some organizations may rely on upstream Content Delivery Network throttling as a secondary control layer, this mitigation is easily bypassed through simple IP rotation techniques available to most attackers using residential proxies or botnets. Consequently, an unauthenticated actor can systematically brute-force the six-digit numeric code with high probability of success within a short timeframe, leading directly to full account takeover.
From a classification perspective, this vulnerability aligns closely with CWE-287, which describes Improper Authentication, as well as CWE-307, representing Improper Restriction of Excessive Authentication Attempts. In the context of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1078, Valid Accounts, specifically illustrating how attackers leverage legitimate credentials or authentication mechanisms to gain unauthorized access. The ability to assume administrative privileges through a brute-force attack on an OTP mechanism represents a severe compromise of integrity and confidentiality within the WordPress ecosystem.
To mitigate this risk immediately, administrators must upgrade SureCart to version 4.9.6 or later where these logical flaws have been addressed by implementing robust rate limiting, account lockout policies after failed attempts, and stricter permission checks that prevent unauthenticated users from initiating verification flows for arbitrary accounts. Until an update is applied, organizations should consider disabling the specific REST endpoint if it is not actively required for business operations, although upgrading remains the only definitive remediation strategy to restore secure authentication practices and protect against account takeover attacks exploiting this logic flaw.