The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to and including 4.2.3. The flaw arises because the plugin does not verify a caller’s identity before updating user details such as email during customer profile synchronization from webhook events. An unauthenticated attacker who knows a customer ID can forge a customer.updated webhook, change a linked WordPress user’s email address—potentially that of an administrator—and then use the normal password‑reset flow to gain full access to the WordPress account and possibly the entire site.

WordPress sites that install the SureCart e‑commerce plugin 4.2.3 or earlier. The problem is triggered when the site has enabled the customer.updated webhook integration and the user account is linked to a SureCart customer record.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to craft a forged customer.updated webhook containing a known customer ID and send it to the site’s unprotected webhook endpoint. The lack of authentication on that endpoint allows the attack to occur without any prior site access. After the attacker changes the email address, they can trigger a password reset for the associated WordPress account to gain privileged access.