Summary
CVE-2026-7655 is a high-severity privilege escalation vulnerability in the SureCart WordPress ecommerce plugin, affecting all versions up to and including 4.2.3. The flaw allows unauthenticated remote attackers to overwrite any linked WordPress user’s email address — including administrator accounts — by exploiting missing identity validation in the plugin’s webhook-driven customer profile synchronization logic. Once the email is replaced, the attacker can initiate a standard WordPress password reset to achieve full account takeover, resulting in complete site compromise.
Technical details
- Root cause: The SureCart plugin fails to validate a user’s identity before processing updates to linked account details (specifically the email address) when synchronizing customer profiles from incoming webhook events. No authentication or ownership check is enforced on the update operation.
- Trigger conditions: The attacker must know a valid SureCart customer ID associated with a target WordPress user account. Customer IDs may be discoverable through order confirmation pages, receipts, or API responses, and may be enumerable in some deployments.
- Attack vector: Unauthenticated network request; no credentials or victim interaction required. The vulnerable webhook-processing endpoint is reachable over the internet.
- Attack chain: (1) Attacker submits a crafted webhook event referencing a target SureCart customer ID with an attacker-controlled email address; (2) the plugin updates the linked WordPress account’s email without verifying the caller’s identity; (3) attacker triggers a standard WordPress "Forgot Password" reset to the newly set email address; (4) attacker gains full access to the WordPress account, including administrator-level access if the targeted customer record is linked to an admin account.
- Impact: Full confidentiality, integrity, and availability impact (C:H / I:H / A:H). A successful attack yields complete control of the WordPress site, enabling arbitrary content modification, data exfiltration, and further system compromise.
Affected software
- SureCart WordPress Plugin, versions ≤ 4.2.3 (all releases up to and including 4.2.3)
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector string:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Attack Complexity is rated High (AC:H) because successful exploitation requires knowledge of a valid SureCart customer ID.
Mitigation and recommended actions
- Immediate action — update the plugin: Upgrade the SureCart WordPress plugin to version 4.2.4 or later. The WordPress.org plugin repository currently serves version 4.4.2 as the latest release. Site administrators should update immediately via the WordPress admin dashboard (Plugins → Updates) or the WordPress CLI (
wp plugin update surecart). - Verify administrator account linkage: Review whether any administrator-privileged WordPress accounts are linked to SureCart customer records. Unlinking admin accounts from SureCart customer profiles reduces the impact window until patching is complete.
- Monitor for unauthorized email changes: Review WordPress user account audit logs for unexpected email address modifications, particularly on accounts with elevated privileges.
- Restrict webhook endpoint access: If operationally feasible, apply network-layer controls (e.g., firewall rules or WAF policies) to limit access to the SureCart webhook endpoint to known SureCart platform IP ranges while patching is being performed.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.