kbrain

CVE-2026-120574

HIGH · CVSS 8.1EPSS 0.3%EU EUVD

The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.

Key facts

CVSS score
8.1 (v3.1)
Severity
HIGH
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-287
EPSS score
0.3% (26th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2026-115669)
Published
November 3, 2026
NVD last modified
November 3, 2026
Status
Deferred

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-115669 in the EU Vulnerability Database. Last updated in EUVD on November 3, 2026.

View on the EU Vulnerability Database

References

Last updated November 4, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain