Executive brief
SureCart is a popular WordPress e-commerce plugin for managing customer accounts and purchases. A flaw in its permission checks allows subscriber-level users to change other users' email addresses—including administrators'—and take over their accounts via password reset. The vulnerability also exposes customer email addresses and identifiers to any authenticated user, making account takeover feasible from a basic subscriber account.
Technical details
The SureCart plugin before version 4.6.3 fails to validate that the account being modified by a customer update action matches the account that was authorized by permission checks. This privilege escalation vulnerability allows an authenticated subscriber-level user to change arbitrary user email addresses through an insecure direct object reference (IDOR). An attacker can modify an administrator's email, trigger a password reset, and gain full account control. Additionally, the plugin discloses customer identifiers and email addresses to any authenticated user, and permits attacker-controlled customer records to be associated with arbitrary users. The vulnerability is reachable with only subscriber-level authentication and was patched in version 4.6.3.
Affected products
- SureCart SureCart before 4.6.3
Timeline
- 2026-09-04: disclosed
- 2026-09-06: advisory
- 2026-09-06: patched: Fixed in version 4.6.3