CVE-2026-120574

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route VerificationCodeController::verify, whose permission callback returns true resolves an attacker-supplied login to any...