CVE-2026-75793: SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login

Q: Which sites are exposed to unauthorized account creation?

Sites using a SureCart version before 4.7.0 are affected. The issue applies even when the WordPress site setting that disables user registration is turned off.

Q: Does an attacker need an existing account or authentication to exploit this?

No. An unauthenticated user can create a WordPress account and receive a logged-in session.

Q: What is the immediate remediation?

Update the SureCart WordPress plugin to version 4.7.0 or later.

Published Sep 6, 2026

Updated

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

Affected Software

1 affected component

SureCart WordPress plugin<4.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/surecart to a version that resolves this vulnerability.
Fixed in 4.7.0

Event History

Sep 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Which sites are exposed to unauthorized account creation?

Sites using a SureCart version before 4.7.0 are affected. The issue applies even when the WordPress site setting that disables user registration is turned off.

Does an attacker need an existing account or authentication to exploit this?

No. An unauthenticated user can create a WordPress account and receive a logged-in session.

What is the immediate remediation?