Description

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-06T07:16:43.097Z",
  "pubdate": "2026-09-06T07:16:43.097Z",
  "executiveSummary": "The SureCart WordPress plugin before version 4.6.3 suffers from a critical vulnerability stemming from inadequate authorization checks during customer record updates. This security flaw enables authenticated users, including those with minimal subscriber-level privileges, to perform unauthorized modifications to customer data.\nThe vulnerability manifests as an Insecure Direct Object Reference (IDOR), allowing an attacker to manipulate the email address associated with arbitrary user accounts, including those with administrative privileges. By successfully changing an administrator's email address, an attacker can trigger a password reset request to an attacker-controlled inbox, leading to full site takeover.\nFurthermore, the vulnerability exposes sensitive customer identifiers and email addresses to any authenticated user, facilitating targeted exploitation. The combination of unauthorized data disclosure and the ability to modify account associations presents a severe risk to the confidentiality, integrity, and availability of the WordPress site. Exploitation does not require elevated privileges, as a standard authenticated account is sufficient to reach the vulnerable endpoint and execute the attack chain.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement proper access control checks within the customer update logic of the SureCart plugin. While the application performs a permission check before initiating an update, it fails to validate that the target customer record identifier corresponds to the authenticated user requesting the change.\nThe exploitation flow begins with the attacker identifying the target customer or administrator user ID. Because the plugin discloses customer identifiers and email addresses to any authenticated user, the attacker can easily enumerate valid targets. Once an attacker-controlled customer record is identified, the attacker intercepts the update request to the SureCart backend.\nBy manipulating the request parameters, the attacker can force the application to update an arbitrary user account, overriding the intended ownership constraints. When an attacker updates a target's email address to one they control, the attacker then leverages the standard WordPress password reset mechanism. Since the WordPress 'lost password' function sends reset tokens to the address stored in the user profile, the attacker receives the reset link and gains full administrative access to the site.\nThe vulnerable component resides in the plugin's customer management API, which lacks sufficient server-side validation to ensure the 'current user' context matches the 'target record' context. This IDOR vulnerability effectively bypasses the authorization layer, allowing unauthorized cross-account modification. Because the vulnerability is accessible to any subscriber-level account, the attack surface is significantly expanded, as no special permissions are required to reach the vulnerable code path.\nThe post-exploitation impact includes complete administrative takeover of the WordPress instance, enabling the attacker to execute arbitrary code, install malicious plugins, exfiltrate sensitive database content, and compromise the integrity of the entire web application ecosystem. The lack of strict parameter validation in the update handler allows for a reliable and repeatable exploitation process."
}