CVE-2026-39488

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The SureCart plugin for WordPress up to version 4.0.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Risk Assessment

The organization risks unauthorized access to cart and payment functions, potentially leading to customer data and transaction breaches.

Recommendation

Update the SureCart plugin to the latest version. Restrict payment settings access to trusted administrators only.

Original NVD description (English source)

Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.