CVE-2026-75793 Overview
The SureCart WordPress plugin before version 4.7.0 contains a broken access control vulnerability that allows unauthenticated attackers to create WordPress user accounts even when site registration is disabled. The plugin fails to check the site's users_can_register option before provisioning accounts through its checkout or customer flows. Successful exploitation returns a logged-in session to the attacker, bypassing the site owner's registration policy. The issue is categorized under [CWE-284] Improper Access Control.
Critical Impact
Unauthenticated attackers can register accounts and obtain authenticated sessions on WordPress sites where registration is explicitly disabled, undermining administrator-enforced access controls.
Affected Products
- SureCart WordPress plugin versions prior to 4.7.0
- WordPress sites running SureCart with the Anyone can register option disabled
- E-commerce deployments relying on SureCart for checkout and customer account creation
Discovery Timeline
- 2026-09-06 - CVE-2026-75793 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-75793
Vulnerability Analysis
SureCart integrates a customer account model with WordPress's native user system. During checkout or customer-facing flows, the plugin creates a corresponding WordPress user and establishes an authenticated session for the caller. The vulnerable code path does not consult the WordPress users_can_register option before performing account creation.
WordPress administrators disable open registration to limit the attack surface exposed to unauthenticated visitors. When SureCart bypasses this setting, it re-introduces that surface. Any subscriber-level capability that the site or other installed plugins expose to authenticated users becomes reachable by any anonymous internet caller.
The attack requires no privileges, no user interaction, and is executed over the network. Impact is limited to confidentiality and integrity of user-scoped resources, since a newly created account holds only the default WordPress role.
Root Cause
The root cause is a missing authorization check [CWE-284]. The account provisioning routine trusts request input rather than reconciling it against the site's registration policy. This is a classic policy-enforcement gap where a plugin bypasses a security-relevant WordPress core setting.
Attack Vector
An unauthenticated attacker sends a request to the SureCart endpoint that triggers customer account creation, supplying attacker-controlled account details. The plugin creates the WordPress user and returns a valid session, granting the attacker interactive access to the site's authenticated user surface. Refer to the WPScan Vulnerability Report for endpoint-level technical details.
Detection Methods for CVE-2026-75793
Indicators of Compromise
- Unexpected wp_users entries created after SureCart was installed, particularly on sites where Anyone can register is unchecked
- Successful wp-login.php or REST authentication events tied to accounts that have no prior order or admin-created history
- POST requests to SureCart customer or checkout endpoints from unfamiliar IP ranges immediately preceding new user rows
Detection Strategies
- Compare the count of WordPress users created per day against SureCart order volume to surface accounts created without a corresponding purchase
- Alert when the user_register action fires while the WordPress option users_can_register is set to 0
- Review web server logs for anonymous requests to SureCart REST routes that return Set-Cookie: wordpress_logged_in_* headers
Monitoring Recommendations
- Ingest WordPress audit logs and web access logs into a centralized analytics platform to correlate account creation with request origin
- Track first-login geolocation and user-agent anomalies for accounts created through SureCart flows
- Monitor for privilege changes on newly created accounts, which may indicate chained exploitation with other plugins
How to Mitigate CVE-2026-75793
Immediate Actions Required
- Update the SureCart plugin to version 4.7.0 or later on all WordPress sites
- Audit the wp_users table for accounts created since the plugin was installed and disable or delete unauthorized entries
- Invalidate active sessions by rotating authentication salts in wp-config.php after cleanup
Patch Information
Upgrade SureCart to version 4.7.0, which adds the missing check against the site's registration setting before creating WordPress accounts. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily disable the SureCart plugin on sites where patching cannot be applied immediately
- Restrict access to SureCart REST endpoints at the web server or WAF layer until the update is deployed
- Enforce CAPTCHA or rate limiting on checkout and customer flows to slow automated account creation attempts
# Verify SureCart version and WordPress registration policy via WP-CLI
wp plugin get surecart --field=version
wp option get users_can_register
# Update SureCart to the patched release
wp plugin update surecart --version=4.7.0
# List users created in the last 30 days for review
wp user list --field=ID,user_login,user_registered,user_email --format=table \
| awk 'NR==1 || $3 >= "'$(date -d "-30 days" +%Y-%m-%d)'"'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
