CVE-2026-7655

In versions of the SureCart plugin up to 4.2.3 for WordPress, an attacker can exploit a vulnerability allowing them to seize control of another user's account by manipulating email addresses associated with linked customers. This occurs because the plugin fails to verify a user's identity before updating their details through customer profile synchronization triggered by webhooks. As a result, unauthenticated attackers can potentially reset passwords and gain access to administrator accounts if they know the corresponding customer ID.

Based on public CVE data (MITRE/NVD).