The SureCart WordPress plugin up to version 4.9.5 contains a vulnerability allowing unauthenticated attackers to take over any user account, including administrators. This is due to a passwordless one-time-code login REST endpoint that lacks proper rate limiting and account lockout mechanisms. Attackers can brute-force the 6-digit verification code to gain authenticated sessions as targeted users.