SureCart WordPress plugin: Authentication bypass by spoofing
Summary
SureCart is a WordPress ecommerce plugin that connects a WordPress site to a cloud commerce platform. Versions up to and including 4.9.5 contain a broken authentication flaw (CWE-290) that allows unauthenticated attackers to bypass the login system or log in as other users without a password. If an administrator account is affected, an attacker could take over the entire website. The vulnerability is network-reachable and requires no user interaction.
Affected
- SureCart WordPress plugin up to and including 4.9.5
- CVSS 3.1: 9.8 (Critical)
- Unknown whether any other products or editions are affected
Fixed in
- Version 4.9.6 (per Patchstack; not yet confirmed by the vendor or the WordPress.org changelog)
Workaround
- No technical workaround is published in the sources reviewed.
- Patchstack advises asking your hosting provider or web developer for help if the update cannot be applied.
- Unknown whether a workaround exists.
Exploitation
- Not marked as known exploited at the time of research (CISA SSVC: Exploitation none, Automatable yes, Technical Impact total).
- Patchstack expects exploitation and states the flaw is used in mass-exploit campaigns; this is a vendor prediction, not evidence of active attacks.
- No public proof of concept found; this means not found, not confirmed absent.
Our recommendation
- Inventory all WordPress sites running SureCart.
- Update SureCart to version 4.9.6 or later as a priority.
- If an update is not possible immediately, consider deactivating SureCart.
- Review administrator accounts and recent logins for unexpected activity.
- Re-verify the fixed version once the vendor or WordPress.org changelog confirms it.
- Monitor for further SureCart vulnerabilities, as several other issues exist in the same version range.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: Broken Authentication in WordPress SureCart Plugin patchstack.com
- GitHub Advisory GHSA-g8wf-f8pm-3fxm github.com
- Strix: CVE-2026-112241 www.strix.ai
- VulDB: CVE-2026-112241 vuldb.com
- Vulners: CVE-2026-112241 vulners.com
- Patchstack vulnerability list for SureCart patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:03.
Original description (NVD)
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.