The vulnerability in the SureCart WordPress plugin allows an attacker to create a WordPress user account without any prior authentication. The plugin does not respect the site’s user registration setting and automatically logs the attacker in after account creation. The impact is the unauthorized creation and use of an account, potentially giving the attacker full access to the site’s administrative functions if the account receives elevated privileges.

Users of the SureCart WordPress plugin running any version older than 4.7.0 are affected. The flaw manifests when the WordPress site has user registration disabled, yet the plugin still creates an account and establishes a session for that new user.

The CVSS score of 6.5 is declared, but the risk is high because creating a user account bypasses all registration controls. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating limited publish‑time exploitation data. The attack vector is likely based on unauthenticated web traffic; an attacker can trigger account creation by visiting a plugin route that creates a user. The lack of a restriction check makes the flaw straightforward to exploit in any exposed WordPress installation using this plugin before version 4.7.0.