VulnSocial

CVE-2026-18480Disclosure

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-09-07); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-07: 1Mentions · 2026-09-08: 1Mentions · 2026-09-09: 1PoC Mentioned / Linked · 2026-09-08: 1Patch / Workaround · 2026-09-07: 1Patch / Workaround · 2026-09-09: 1Technical Details · 2026-09-07: 1Technical Details · 2026-09-08: 1Technical Details · 2026-09-09: 109-0709-0809-09
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-071
Disclosure1
2026-09-081
Disclosure1
2026-09-091
Patch1
Full discourse3 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-18480 (CVSS 8.8) SureCart WordPress plugin <4.6.3 allows subscriber-level accounts to hijack admin accounts via email change & password reset. Patch immediately to v4.6.3+ #CVE #Vulnerability #PatchNow #WordPress https://t.co/IqNnqu7Irm

    Post summary

    The tweet announces the CVE-2026-18480 vulnerability in the SureCart WordPress plugin, emphasizing high severity and urging users to upgrade to version 4.6.3 or later to remediate the exploit that allows subscriber accounts to hijack admin accounts via email/password changes.

    0000043
    129 followersView on X
  • LoreleiWeb@LoreleiWeb
    Disclosure

    🆕👉 SureCart < 4.6.3 - Subscriber Account Takeover via Customer Update Access Control Flaw https://wpdeeply.com/surecart-4-6-3-subscriber-account-takeover-customer-update-access-control/ #loreleiweb CVE-2026-18480 is a newly published broken access control vulnerability in the SureCart WordPress ecommerce plugin. The issue affects SureCart versi… https://t.co/c7pht13Ej2

    Post summary

    A newly published broken access control vulnerability (CVE‑2026‑18480) in SureCart <4.6.3 allows subscriber account takeover through a customer update access control flaw; details are available via the linked article.

    00000256
    85.9K followersView on X
  • ADK Cyber@ADKCyber
    Disclosure

    SureCart WordPress plugin before 4.6.3 contains high-severity auth issue (CVSS 8.8). SMBs using it should verify and update immediately: https://nvd.nist.gov/vuln/detail/CVE-2026-18480 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/8CjjYlcr8k

    Post summary

    The SureCart WordPress plugin (v<4.6.3) has a high‑severity authentication vulnerability (CVSS 8.8). The post urges SMBs to verify and apply the update immediately.

    0000063
    93 followersView on X

Explore more

Back to dashboard