Quick answers
- Is CVE-2026-120574 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120574 being exploited in the wild.
- How severe is CVE-2026-120574?
- High severity, with a CVSS score of 8.1, published 3 November 2026.
- Which products and versions are affected?
- SureCart Up to and including 4.9.5.
- Is there a fix for CVE-2026-120574?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-120574 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-120574?
- Check whether you run SureCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The VerificationCodeController REST endpoint permits unauthenticated requests with a permission callback that unconditionally returns true. An attacker can request a verification code for any user via an unauthenticated endpoint, then brute-force the 6-digit code with no per-account attempt counter, IP-based rate limiting, or lockout mechanism; successful code verification calls wp_set_auth_cookie() to establish an authenticated session as the targeted user, including administrators. Although the code contains constants for attempt limits and lockout windows, these protections are not enforced in the verify() function logic.
Affected products
- SureCart SureCart Up to and including 4.9.5
Timeline
- 2026-11-03: disclosed