# CVE-2026-7655: SureCart WordPress plugin privilege escalation via account takeover

Source: https://junglewise.ai/threats/cve-2026-7655-surecart-wordpress-plugin-privilege-escalation-via-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-7655 · Severity: high · CVSS 8.1 · Published 2026-07-11

SureCart, a popular e-commerce plugin for WordPress, contains a security flaw that could allow unauthorized individuals to take over user accounts. By exploiting a weakness in how the plugin syncs customer data, an attacker could change the email address associated with an account, including those of site administrators. Once the email is changed, the attacker can use standard password reset tools to gain full control of the website, potentially leading to data theft or complete site disruption.

Technologies: [SureCart](https://junglewise.ai/threats/technologies/surecart). Vendors: [SureCart](https://junglewise.ai/threats/vendors/surecart).

## Quick answers

**Is CVE-2026-7655 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7655 being exploited in the wild.

**How severe is CVE-2026-7655?** High severity, with a CVSS score of 8.1, published 11 July 2026.

**Which products and versions are affected?** SureCart up to, and including, 4.2.3.

**Is there a fix for CVE-2026-7655?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7655 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7655?** Check whether you run SureCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SureCart plugin for WordPress is vulnerable to an account takeover and privilege escalation flaw due to insufficient identity validation during customer profile synchronization from webhook events. Specifically, the plugin fails to properly verify a user's identity before updating sensitive details like email addresses. An unauthenticated attacker who knows a target's customer ID can trigger a webhook event to change the email address of a linked WordPress user, including administrators. Once the email is updated, the attacker can initiate a standard WordPress password reset to gain full access to the account. This vulnerability is addressed in versions following 4.2.3.

## Affected products

- surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments up to, and including, 4.2.3

## Timeline

- 2026-07-11: advisory: NVD and Wordfence published the advisory.
- 2026-07-11: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3532438/surecart](https://plugins.trac.wordpress.org/changeset/3532438/surecart)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f5f7b-6698-4275-a362-15e5441e0fa9?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f5f7b-6698-4275-a362-15e5441e0fa9?source=cve)

## Related threats

- [SureCart plugin for WordPress unauthenticated account takeover](https://junglewise.ai/threats/cve-2026-120574-the-surecart-plugin-for-wordpress-is-vulnerable-to)
- [SureCart plugin stored cross-site scripting in comments](https://junglewise.ai/threats/cve-2026-107653-the-surecart-ecommerce-made-easy-for-selling-physical-products)
- [SureCart Stored Cross-Site Scripting in comment parameter](https://junglewise.ai/threats/cve-2026-109224-the-surecart-ecommerce-made-easy-for-selling-physical-products)
- [SureCart WordPress plugin unauthenticated account creation bypass](https://junglewise.ai/threats/cve-2026-75793-surecart-wordpress-plugin-unauthenticated-account-creation-bypass)
- [SureCart plugin privilege escalation and account takeover](https://junglewise.ai/threats/cve-2026-18480-surecart-plugin-privilege-escalation-and-account-takeover)