CVE-2026-7655 is a high-severity vulnerability in the SureCart WordPress plugin that arises from improper validation of user identity before updating email addresses during customer profile synchronization from webhook events. This flaw allows unauthenticated attackers to change the email address of linked users, including administrators, if the attacker knows the customer ID. By changing the email, attackers can trigger password reset mechanisms to gain unauthorized access to user accounts, resulting in privilege escalation and full account takeover.

Successful exploitation can lead to full account takeover of affected SureCart users, including administrators if their accounts are linked to SureCart customer records. This compromises confidentiality, integrity, and availability of the affected accounts and potentially the entire WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to webhook endpoints and monitor for suspicious activity related to customer profile updates. Avoid linking administrator accounts to SureCart customer records where possible.