CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 contains an improper privilege management flaw (CWE-269): it does not verify that the account modified during a customer update is the same account its permission check authorized. A user with only a subscriber-level account can trigger the update and change the email address of another user, including an administrator, then take over that account through the standard password-reset flow. The flaw is compounded by the ability to associate an attacker-controlled customer record with an arbitrary user and by disclosure of customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber account alone. Any WordPress site running an affected version of the plugin is exposed, with administrator accounts the primary high-value targets. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Upgrade the SureCart plugin to version 4.6.3 or later on every site where it is active. As an interim mitigation, restrict or disable open user registration and monitor for unexpected email-address changes on accounts, especially administrators. Admins who find unexplained email changes should reset credentials and review recent password-reset activity for signs of account takeover.