CVE-2026-18480: CWE-269 Improper Privilege Management in SureCart

CVE-2026-18480 is a privilege management vulnerability in the SureCart WordPress plugin prior to version 4.6.3. The plugin fails to verify that the account affected by a customer update matches the account authorized by the permission check. This allows users with subscriber-level privileges to modify other users' email addresses, including administrators, facilitating account takeover through password reset mechanisms. Additionally, the vulnerability enables attacker-controlled customer records to be linked to arbitrary users and leaks customer identifiers and email addresses to any authenticated user, making exploitation possible from a low-privilege account.

An attacker with subscriber-level access can change the email address of other users, including administrators, and take over those accounts via password reset. The vulnerability also exposes customer identifiers and email addresses to any authenticated user, increasing the risk of targeted attacks and unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions and monitor for suspicious account changes. Avoid granting unnecessary authenticated access to untrusted users.