CVE-2026-112241

Summary

The SureCart plugin for WordPress prior to version 4.9.6 contains an authentication bypass vulnerability (CWE-290) that allows unauthenticated attackers to spoof authentication and gain unauthorized access to protected resources.

Exploitability

Exploitation is straightforward for remote attackers due to the CVSS vector indicating network accessibility, low attack complexity, and no user interaction or privileges required.

Blast radius

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system, including unauthorized data access, modification of critical content, and service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SureCart version 4.9.6 or later, which contains the official patch for this authentication bypass flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.