PT-2026-57403 · WordPress · Surecart

Supakiad S · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-7655

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SureCart versions prior to 4.2.4

Description An issue exists that allows privilege escalation via account takeover. The software fails to properly validate a user's identity when updating details, such as the email address, during customer profile synchronization from webhook events. An unauthenticated attacker who knows the customer ID can change the linked user's email address, including that of an administrator if the account is linked to a SureCart customer record, and subsequently reset the password to gain unauthorized account access.

Recommendations Update SureCart to version 4.2.4 or later.

Fix

LPE

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-7655

Affected Products

Surecart

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7655 · Security Note
• https://twitter.com/CVEnew/status/2075869790820778256 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3532438/surecart · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e19f5f7b-6698-4275-a362-15e5441e0fa9?source=cve · Note
• https://twitter.com/infoflowcloud/status/2075871725896528268 · Twitter Post