CVE-2026-120574

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to and including 4.9.5 . The vulnerability exists in the passwordless one-time-code login REST route (VerificationCodeController::verify() ), which lacks a per-account attempt counter, persisten...