CVE-2026-112241: WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SureCart pluginto a version that resolves this vulnerability.Fixed in 4.9.6
Event History
Frequently Asked Questions
Which SureCart installations are affected?
SureCart versions through 4.9.5 are affected. The available data does not identify any unaffected or fixed version.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What could an attacker achieve if exploitation succeeds?
The vulnerability is rated critical and the CVSS vector indicates high impact to confidentiality, integrity, and availability. It is described as an authentication bypass by spoofing that enables authentication abuse.