Advisory · CVE-2026-120574
SureCart passwordless login code brute force allows administrator account takeover
SureCart up to and including 4.9.5 lets unauthenticated attackers brute-force the 6-digit passwordless login code for any user, including administrators, because the verification path has no per-account attempt counter, lockout, or rate limit.
- Vendor
- SureCart
- Product
- SureCart
- Identifier / CWE
- CVE-2026-120574
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The login code is only six digits, and the door lets you guess as many times as you like without locking. An attacker can simply try every combination for the administrators account until one opens the door.
- 01Code triggered for any user
An unauthenticated attacker triggers a passwordless login code for any user, including an administrator, through the companion unauthenticated endpoint.
- 02No attempt limit
The verification route has no per-account attempt counter, no persistent email or IP lockout, and no rate limit that holds: the upstream CDN throttle is bypassable by rotating IP addresses.
- 03Six-digit code brute-forced
The attacker tries codes until one verifies, which is feasible against a 6-digit space with unlimited attempts.
- 04Session issued
On success the handler logs the user in and issues an authenticated session for a user of any role, including administrator.
What happened
SureCart versions up to and including 4.9.5 contain an unauthenticated account takeover vulnerability in the passwordless one-time-code login flow. The verification route resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success issues an authenticated session for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email or IP lockout or rate limit, and no restriction preventing high-privilege accounts from being logged in through it. The record rates it high at CVSS 8.1.
The vendor changelog for SureCart 4.9.6, dated October 16, 2026, notes strengthened security of the passwordless login code flow, and the NVD affected range ends at 4.9.5, so 4.9.6 or later is outside the stated affected range; the current release is 4.11.0, which additionally rate-limits login code emails. SureCart reports 80,000 active installs per the WordPress.org plugin API, and as a checkout and payments platform it holds the keys to store revenue, so an authentication bypass here is a direct path to store takeover.
What to do
- Inventory WordPress sites running SureCart and record each version.
- Update to SureCart 4.9.6 or later, ideally the current 4.11.0 release.
- Until updated, monitor login code verification endpoints for brute-force patterns such as repeated attempts against a single account, and consider disabling passwordless login.
- Review authentication logs for administrator logins that followed passwordless code verification, and force password resets plus session invalidation if a takeover cannot be excluded.
- Verify the deployed version after updating.
Management note
A six-digit code is only a lock if guessing is limited. Unlimited attempts turn a short code into no code at all, and when the same flow serves administrators, the store has no authentication left. Rate limits and lockouts are not friction here, they are the entire security model.