Executive brief
SureCart is a WordPress plugin for accepting payments and managing customer accounts on e-commerce websites. The plugin version before 4.7.0 ignores the WordPress site setting that disables user registration, allowing attackers to create new user accounts and gain immediate login access even when the site administrator has explicitly disabled public registration. This can lead to unauthorized account takeover and potential access to customer data or admin functions.
Technical details
The vulnerability is an access control bypass (CWE-284) in the SureCart WordPress REST API endpoints. The plugin's checkout creation and confirmation endpoints (/wp-json/surecart/v1/checkouts and /wp-json/surecart/v1/checkouts/{id}/confirm) do not check the WordPress site's users_can_register setting before creating new user accounts and issuing authenticated sessions. An unauthenticated attacker can POST to these endpoints to create a checkout, PATCH it with email/password/name credentials, and confirm it to receive a valid wordpress_logged_in cookie and a new subscriber account, completely bypassing the site's registration restrictions. No payment is required; the checkout remains in draft status. The vulnerability was fixed in version 4.7.0.
Affected products
- SureCart SureCart before 4.7.0
Timeline
- 2026-09-04: disclosed
- 2026-09-06: advisory
- 2026-09-06: patched: Fixed in version 4.7.0