CVE-2026-112840

The SureCart plugin in versions up to and including 4.7.2 contains a Privilege Escalation vulnerability exploitable by a user with Shop Worker privileges.

An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.

SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains an untrusted data deserialization vulnerability that allows Object Injection.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS. This issue affects SureCart: from n/a through 4.9.4.

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.

The SureCart plugin for WordPress up to version 4.2.3 is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of user identity before updating details like email during customer profile synchronization from webhook events. Unauthenticated attackers can change linked user email addresses, including administrators if their account is linked to a SureCart customer record, and then reset the password to gain access if the customer ID is known.

SureCart plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.