VulnSocial

CVE-2026-120574

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-03: 111-03
Referenced assets4 URLs
Full discourse1 post
  • ♫Why♥Not♪@Python_s_

    #NØØT_Security_Alerts 🚨 #ALERT — SureCart Passwordless Login Flaw Enables Conditional WordPress Admin Account Takeover October 30, 2026 PRODUCT: SureCart WordPress e-commerce plugin. CVE: CVE-2026-120574 | HIGH (CVSS 3.1: 8.1). AFFECTED: Versions ≤4.9.5. FIRST FIX: 4.9.6 (October 16). LATEST VERIFIED: 4.12.0 (November 3), with further passwordless-login hardening. IMPACT: An unauthenticated attacker can request a six-digit login code for a targeted account, including an administrator. Missing per-account attempt limits in affected versions permit guessing across rotating IPs. A successfully guessed valid code can establish a session as that user. EXPLOITATION STATUS: Wordfence-documented vulnerability. No confirmed malicious exploitation established in the cited sources. The CVE record was published November 3; that was not the original patch date. TRIAGE: Correlate login-code requests and repeated verification failures across IPs; investigate unexpected admin sessions or account changes. These signals are not conclusive IoCs. URGENT ACTION: Back up and test, then upgrade to verified SureCart 4.12.0 or a newer fixed release. Confirm the running version. If updating is delayed, restrict exposed login routes using tested controls. Preserve evidence on suspected compromised sites, terminate unauthorized sessions and investigate persistence. Patching alone cannot revoke existing sessions. SOURCES: https://www.wordfence.com/threat-intel/vulnerabilities/id/dffdcaa2-5100-48f5-9b82-e22075fd87e5?source=api-prod https://surecart.com/changelog/surecart-4-9-6-variant-rich-results-security-fixes/ https://wordpress.org/plugins/surecart/ https://www.cve.org/CVERecord?id=CVE-2026-120574 CONFIDENCE: HIGH for Wordfence’s vulnerability findings and vendor release history; LIMITED for real-world exploitation. #CyberSecurity #WordPress #AppSec #CVE #InfoSec #IncidentResponse #VulnerabilityManagement #ThreatIntel

    0000056
    233 followersView on X

Explore more

Back to dashboard