{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39488", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:47:37.759Z", "datePublished": "2026-04-08T08:30:11.861Z", "dateUpdated": "2026-04-08T08:30:11.861Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "surecart", "product": "SureCart", "vendor": "SureCart", "versions": [{"changes": [{"at": "4.0.3", "status": "unaffected"}], "lessThanOrEqual": "4.0.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc) | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:58.135Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects SureCart: from n/a through <= 4.0.2.</p>"}], "value": "Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:11.861Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/surecart/vulnerability/wordpress-surecart-plugin-4-0-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2."}], "id": "CVE-2026-39488", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:23.670", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/surecart/vulnerability/wordpress-surecart-plugin-4-0-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "SureCart", "source": "cna", "vendor": "SureCart"}, "product": "surecart", "vendor": "surecart"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:17:59.452358+00:00", "value": {"mitigation_remediation": ["Upgrade the SureCart plugin to version 4.0.3 or later to eliminate the missing authorization checks.", "If an immediate upgrade is not possible, restrict access to the plugin\u2019s administrative URLs by limiting them to specific IP addresses or by removing the URLs from the public-facing WordPress installation."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The problem affects the SureCart plugin for WordPress up through version 4.0.2. All installations of these versions are vulnerable, regardless of site configuration or other plugins. Users of earlier or later releases are not affected.", "description_and_impact": "A broken access control flaw exists in the SureCart WordPress plugin that allows attackers to bypass authentication checks and gain unauthorized access to privileged functions and data. The vulnerability arises because authorization layers are missing or incorrectly implemented on certain administrative endpoints, enabling attackers to perform actions that should be restricted to admin users. The exploit can result in disclosure of sensitive information and modification of store settings, directly impacting the confidentiality and integrity of the website\u2019s data.", "risk_and_exploitability": "The flaw is accessible over the web, and an attacker only needs to send crafted requests to the plugin\u2019s endpoints. No special credentials are required, meaning both authenticated and unauthenticated users could exploit it. The CVSS score is not publicly listed; the EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. However, the ease of exploitation and the potential for significant damage suggest a high risk profile for exposed sites."}}}}, "created": "2026-04-08T19:30:40.151659+00:00", "updated": "2026-04-08T19:43:10.198201+00:00", "vendors": ["surecart", "surecart$PRODUCT$surecart", "wordpress", "wordpress$PRODUCT$wordpress"]}