SureCart Plugin up to 4.9.5 on WordPress Passwordless One-Time-Code Login verify permission

Summaryinfo

A vulnerability classified as critical was found in SureCart Plugin up to 4.9.5. This impacts the function VerificationCodeController::verify of the component Passwordless One-Time-Code Login. The manipulation results in permission. This vulnerability is cataloged as CVE-2026-120574. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in SureCart Plugin up to 4.9.5. Affected is the function VerificationCodeController::verify of the component Passwordless One-Time-Code Login. The manipulation with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-120574 since 11/02/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/03/2026). The MITRE ATT&CK project declares the attack technique as T1222.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• SureCart Plugin

Version

• 4.9.0
• 4.9.1
• 4.9.2
• 4.9.3
• 4.9.4
• 4.9.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion