CVE WATCH / VULNERABILITY DETAIL
CVE-2026-120574
HIGHCVSS 8.1NVD feed
Published 3 November 2026 · tracked since 3 November 2026
Description
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any W
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-121443 MEDIUM 5.3
- CVE-2026-121444 HIGH 7.5
- CVE-2026-121435 MEDIUM 4.3
- CVE-2026-121436 HIGH 7.2
- CVE-2026-121417 HIGH 7.8
- CVE-2026-121392 HIGH 7.4
- CVE-2026-118527 MEDIUM 4.3
- CVE-2026-106991 HIGH 7.1
- CVE-2026-119742 HIGH 7.2
- CVE-2026-119179 HIGH 7