CVE-2026-75793 in SureCart Plugin
Summary
by MITRE • 09/06/2026
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified in SureCart versions prior to 4.7.0 represents a critical authentication bypass flaw rooted in improper access control mechanisms within the plugin's user creation logic. Specifically, the software fails to validate the WordPress site-level configuration regarding user registration before initiating the account provisioning process. In standard WordPress environments, administrators can disable public user registration through specific settings, intending to restrict account creation exclusively to administrative actions or pre-approved methods. However, this vulnerability allows unauthenticated external actors to bypass these restrictions entirely by directly interacting with the plugin's endpoints responsible for creating new accounts. This architectural oversight means that the security boundary defined at the core WordPress level is effectively ignored when the SureCart functionality is invoked, leading to a state where any internet user can generate valid credentials and obtain an authenticated session without prior authorization or approval from site administrators.
From a technical perspective, this flaw aligns with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration, as it results in the unauthorized creation of persistent sessions for users who should not have access to any part of the system that requires authentication. The operational impact is significant because newly created accounts often inherit default capabilities or can be escalated depending on subsequent plugin configurations. An attacker leveraging this vulnerability could gain a foothold within the WordPress environment, potentially accessing restricted content, manipulating e-commerce data if such features are enabled for new users, or using the account as a pivot point for further attacks against other authenticated plugins and themes installed on the same instance. This type of flaw is particularly dangerous in multi-site installations or public-facing commerce platforms where trust boundaries must be strictly enforced to prevent unauthorized access to sensitive business logic and customer data.
In terms of threat modeling, this vulnerability facilitates initial access through automated exploitation tools that can rapidly scan for vulnerable instances and create backdoor accounts without needing valid credentials first. This behavior is consistent with techniques observed in the MITRE ATT&CK framework under T1078 Valid Accounts, where adversaries establish persistence by creating legitimate-looking user profiles to maintain long-term access to compromised systems. The ability to register as a new user also opens avenues for privilege escalation if default role assignments are misconfigured or if specific plugins grant elevated permissions upon registration, thereby expanding the attack surface beyond simple unauthorized account creation into potential full system compromise depending on the broader security posture of the WordPress installation.
To mitigate this risk, immediate action is required to update the SureCart plugin to version 4.7.0 or later, where the developers have implemented proper checks against the site's user registration settings before allowing account creation. Administrators should also audit existing user accounts for any suspicious entries that may have been created during the window of vulnerability and remove unauthorized users promptly. Furthermore, it is advisable to review WordPress security configurations by ensuring that only necessary plugins are active and that role-based access controls are tightly configured to minimize the impact if similar vulnerabilities exist in other components. Regular monitoring of login attempts and user creation logs can help detect exploitation activities early, providing an additional layer of defense against automated attacks targeting this specific class of authentication bypass flaws.