The issue is an authentication bypass that allows attackers to spoof credentials and authenticate as arbitrary users within the SureCart plugin. This flaw therefore enables unauthorized access and potentially privilege escalation, with the threat of further exploitation if an attacker uses the granted session for administrative actions. The weakness is a form of authentication abuse (CWE‑290).

The vulnerability affects the WordPress plugin Brainstorm Force SureCart up to version 4.9.5, inclusive of all earlier releases; it does not apply to any later releases such as 4.9.6 and beyond.

The CVSS score of 9.8 signals critical severity and indicates that the flaw can be leveraged by unauthenticated users to gain full privileges. With no EPSS data available, the exact likelihood of exploitation remains unknown, but the CVE is not listed in the CISA KEV catalog, which means there are no confirmed, widespread exploitation reports yet. The attack vector is inferred to be through HTTP requests to the plugin's authentication endpoints, as the attack requires only the ability to send crafted credentials. The flaw remains present until the plugin is updated to at least version 4.9.6.