CVE-2026-7655
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The SureCart plugin for WordPress up to version 4.2.3 is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of user identity before updating details like email during customer profile synchronization from webhook events. Unauthenticated attackers can change linked user email addresses, including administrators if their account is linked to a SureCart customer record, and then reset the password to gain access if the customer ID is known.
Risk Assessment
The risk for the organization is the potential takeover of an administrator account by an unauthenticated attacker, leading to full compromise of the WordPress site and customer data.
Recommendation
Immediately update the SureCart plugin to the latest available version that fixes this vulnerability. Also review all user accounts for unauthorized email changes.
Other vulnerabilities in SureCart
See all- CVE-2026-9065Critical
SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.
- CVE-2026-32548Medium
Broken Access Control vulnerability in SureCart versions up to 4.6.2 allows an unauthenticated attacker to bypass access controls.
- CVE-2026-57314High
SureCart plugin version 4.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-39488Medium
The SureCart plugin for WordPress up to version 4.0.2 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.