{"id":"CVE-2026-112241","published":"2026-10-22T09:17:14.157","lastModified":"2026-10-22T15:15:23.833","description":"Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/surecart/vulnerability/wordpress-surecart-plugin-4-9-5-broken-authentication-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SureCart plugin for WordPress prior to version 4.9.6 contains an authentication bypass vulnerability (CWE-290) that allows unauthenticated attackers to spoof authentication and gain unauthorized access to protected resources.","exploitability":"Exploitation is straightforward for remote attackers due to the CVSS vector indicating network accessibility, low attack complexity, and no user interaction or privileges required.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system, including unauthorized data access, modification of critical content, and service disruption.","remediation":"Upgrade to SureCart version 4.9.6 or later, which contains the official patch for this authentication bypass flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","spoofing","web","wordpress-plugin"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:56:36.337Z"}}