CVE-2026-120574

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route VerificationCodeController::verify, whose permission callback returns true resolves an attacker-supplied login to any...

EUVD-2026-115669

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route VerificationCodeController::verify, whose permission callback returns true resolves an attacker-supplied login to any...

CVE-2026-120574 SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route VerificationCodeController::verify, whose permission callback returns true resolves an attacker-supplied login to any...

CVE-2026-120574

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to and including 4.9.5 . The vulnerability exists in the passwordless one-time-code login REST route (VerificationCodeController::verify() ), which lacks a per-account attempt counter, persisten...