Description

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-06T07:16:43.220Z",
  "pubdate": "2026-09-06T07:16:43.220Z",
  "executiveSummary": "The SureCart WordPress plugin before version 4.7.0 contains a critical authentication bypass vulnerability that allows unauthenticated remote attackers to register new WordPress user accounts. This flaw stems from the plugin's failure to validate the site-wide 'Anyone can register' setting within the WordPress configuration.\nThe vulnerability poses a severe risk to site integrity and security, as it grants unauthorized individuals the ability to bypass registration restrictions. By successfully exploiting this flaw, an attacker can create accounts and immediately obtain an active, authenticated session. This capability circumvents standard administrative controls governing user onboarding and access management. The exploit requires no special privileges or prior authentication, making it trivial for an attacker to leverage for unauthorized access, potentially leading to unauthorized data access, further privilege escalation, or persistence within the WordPress environment. Administrators of affected systems are at high risk of unauthorized user accumulation, which could be leveraged to disrupt operations or gain unauthorized entry into restricted site areas.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the user registration process within the SureCart plugin. Specifically, the plugin's registration logic fails to perform a check against the WordPress core 'users_can_register' option (retrievable via get_option('users_can_register')). In standard WordPress deployments, this configuration setting acts as the primary gatekeeper for the wp-login.php?action=register process.\nBy neglecting to verify this setting, the SureCart registration endpoint executes its account creation routine regardless of the administrative policy on the site. The attack flow begins with an unauthenticated actor sending a specially crafted request to the SureCart registration endpoint. Because the plugin does not gate this function, it proceeds to invoke core WordPress user registration functions, such as wp_insert_user, followed by automatic authentication logic (e.g., wp_set_current_user and wp_set_auth_cookie).\nThe exploitation process is as follows: 1) The attacker identifies the SureCart plugin's public registration hook. 2) The attacker submits the required registration data (e.g., username, email, password) to this endpoint. 3) The plugin processes the request without validating if registration is enabled on the WordPress installation. 4) The server creates the new user record in the wp_users table. 5) The plugin completes the registration flow by generating a session token and returning an authenticated state to the attacker. This results in the attacker gaining an active session as a newly created user, effectively bypassing the 'Anyone can register' restriction. Because this logic is executed within the plugin's request handling cycle, it remains accessible to any network-exposed instance running an affected version (pre-4.7.0). The lack of prerequisite authentication or privilege levels makes this an highly exploitable vulnerability with a low barrier to entry for potential adversaries."
}