CVE-2026-18480: SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SureCart (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.6.3 - Compensating control
Ensure subscriber-level accounts cannot trigger customer record updates that can change another user's email address; restrict this functionality to authorized roles only (at the application/authorization layer) to prevent account takeover via password reset.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with a subscriber-level account can reach the account takeover path. The exposed customer identifiers and email addresses are also disclosed to authenticated users, providing the information needed to target another account.
What access does an attacker need to take over an administrator account?
The attacker needs only a subscriber-level WordPress account. They can associate an attacker-controlled customer record with an arbitrary user, change the target user's email address, and then use a password reset to take over the account.
Are administrator accounts the only accounts at risk?
No. The flaw allows a subscriber-level user to change another user's email address, so any target user account may be affected; administrator takeover is the highest-impact outcome described.
What version addresses the issue?
SureCart versions before 4.6.3 are affected. Updating to version 4.6.3 or later addresses the affected version range.