SureCart WordPress plugin lets attackers brute-force one-time codes to take over admin accounts

Summary

The SureCart WordPress plugin lets an unauthenticated attacker brute-force a 6-digit login code and take over any WordPress account, including administrators. All versions up to and including 4.9.5 are affected.

What to do

No fixed version is named in the sources. Check that the plugin runs a version newer than 4.9.5, and read the vendor's advisory.

Products and platforms

• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments

CVE IDs

• CVE-2026-120574 (opens in a new tab)

Sources

• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 04:43 UTC

First seen 2026-11-09 14:10 UTC