CVE-2026-106599: WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureCart pluginto a version that resolves this vulnerability.Fixed in 4.9.4
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low attack complexity, and requires low privileges. No user interaction is required.
What is the potential impact if exploitation succeeds?
The listed CVSS impacts are high for confidentiality, integrity, and availability. Successful exploitation could therefore expose data, alter data, or disrupt service, depending on the application environment and available object chains.
Which SureCart versions are affected?
SureCart versions through 4.9.3 are affected. The available data does not identify a fixed version.
Are default installations affected?
The provided information does not state whether a default SureCart configuration is affected or identify any required feature configuration.