CVE-2026-7655

SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

2026-07-10 16:08
Supakiad S. (m3ez)

Strategic Overview

Status
Patched in 4.3.0
Affected Plugin
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
Affected Version
<= 4.2.3
CVSS
8.1High
Weakness type
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
CVE
CVE-2026-7655
View all SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments vulnerabilities

At a glance

CVE-2026-7655 is a high-severity Weak Password Recovery Mechanism for Forgotten Password vulnerability in the SureCart WordPress plugin, affecting versions <= 4.2.3. It carries a CVSS score of 8.1 (reachable over the network; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 4.3.0; sites on affected versions should update now. Disclosed July 2026, reported by Supakiad S. (m3ez).

Vulnerability Overview

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Reaching this weakness in SureCart <= 4.2.3 takes no account at all. A weak password recovery mechanism means the path that lets someone back into an account without their password is easier to complete than the password itself.

An attacker takes over an account through the recovery flow without ever seeing the password, and on an administrator account that is full control of the site. For SureCart the fix is 4.3.0: builds <= 4.2.3 are affected, anything from 4.3.0 onward is not.

Remediation

Update to version 4.3.0, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: SureCart 4.3.0 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-7655https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f5f7b-6698-4275-a362-15e5441e0fa9https://nvd.nist.gov/vuln/detail/CVE-2026-7655

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C