CVE-2026-112241: SureCart 4.9.5 Is Unauth Auth Bypass - Floor 4.9.6

CVE-2026-112241 is Patchstack’s name for an unauthenticated authentication bypass in SureCart (surecart) through 4.9.5. They score it 9.8 critical (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-290: Authentication Bypass by Spoofing. The CVE record went PUBLISHED on 22 October 2026; Patchstack’s datePublic is 20 October 2026. Finder credit: Deva Parekh | Patchstack Bug Bounty Program. Floor in the CNA: 4.9.6.[1][2][8]

The wordpress.org plugin API this morning returned version 4.10.0, active_installs 80000 (the directory’s 80k bucket), last updated 2026-10-20 7:00pm GMT, tested to 7.1.3, requires WP 6.8 / PHP 7.4. Author profile: surecart. Plugin header on the 4.10.0 tag names SureCart; the CNA vendor string is Brainstorm Force.[6][5][1]

What it is

This is CWE-290 in the SureCart plugin on wordpress.org, not a WordPress core bug and not PHP2Shell.[1][2]

Patchstack’s CNA text: Authentication Bypass by Spoofing in SureCart allows Authentication Abuse, affected through 4.9.5, package surecart. The CVSS vector is unauthenticated (PR:N), no user click (UI:N), scope unchanged, C/I/A all high.[1][2]

Patchstack’s HTML advisory (the public write-up, not a second CVE) classifies it Broken Authentication, required privilege Unauthenticated, and the one-line impact they print is: attackers can bypass the login system or log in as other users without their password. They name patched version 4.9.6. Timeline on that page: reported by Deva Parekh 14 Oct 2026, published 20 Oct 2026.[8]

We did not dump the 4.9.5 PHP to name an endpoint, nonce, or cookie. Treat “login as other users without a password” as Patchstack’s published claim, not as a request we sent.[1][8]

Vendor changelog does not print this CVE ID. Closest published security bullets:

4.9.6 (16 Oct): “Strengthened security of the passwordless login code flow (props to Wordfence)”; also WPScan-credited data-access scoping and a same-site checkout success-URL restriction.[4]
4.10.0 (20 Oct): “Strengthened security of the passwordless login code flow (props to PatchStack)”; “Hardened REST API request handling so requests only reach the intended endpoints (props to PatchStack)”; “Improved validation of block icons and checkout redirect URLs (props to PatchStack).”[5]

CNA unaffected change is at 4.9.6.[1] We did not map Deva Parekh’s finding onto one changelog line. Do not assume 4.9.6 is the Patchstack-credited passwordless bullet - that credit on 4.9.6 is Wordfence.[4] The Patchstack-credited passwordless line is on 4.10.0.[5] Inventory to 4.9.6 or later because that is the CNA floor; ship 4.10.0 because that is what wordpress.org is serving this morning.[6]

How serious

A 9.8 with C:H I:H A:H and PR:N is “unauthenticated, total impact on the scored component,” not a claimed eval as root. In WordPress terms that usually means a session or role the attacker should not have. Patchstack’s article body is the login-bypass sentence above. It is not a claimed unauth file upload, plugin install, or PHP2Shell.[1][2][8]

CISA’s SSVC row on the NVD object (timestamp 2026-10-22T10:48:22Z, role CISA Coordinator): exploitation: none, automatable: yes, technicalImpact: total. That is CISA’s coordinator assessment on the NVD record, not a KEV listing.[2]

This CVE is not in CISA KEV as of catalog 2026.10.23 (dateReleased 2026-10-23T19:30:18.9209Z, 1756 entries). Newest dateAdded on that dump: 23 Oct Collabora CODE / Arista VeloCloud - not WordPress. Absence from KEV is not a clean bill of health; it means CISA has not listed confirmed in-the-wild under that program.[3]

Tenable mirrors the same CNA description and 9.8, and printed EPSS 0.00346 on the page we pulled this morning. EPSS is a model, not a hunt.[7]

NVD vulnStatus is Deferred. No NVD-assigned 3.1 of its own on the object we fetched - the 9.8 is Patchstack’s, type Secondary.[2]

Who is affected

In scope, per the CNA / NVD affected block:[1][2]

Any site with surecart ≤ 4.9.5 active. No login required on the vector they published.
Abandoned copies stuck on 4.8.x / 4.7.x - the range is through 4.9.5, defaultStatus unaffected only from 4.9.6.
SureCart is a checkout / subscriptions / customer-dashboard plugin. If it is installed and active, assume its login and REST surfaces are reachable unless you have evidence they are not.

Out of scope unless you have a separate advisory:

The free plugin already on 4.9.6 or 4.10.0 (API version this morning is 4.10.0).[6]
WordPress core.
WooCommerce. Different product. Not in this CVE’s affected block.[1]
SureCart’s cloud payment platform. This ID is the wordpress.org plugin package surecart.[1]

What to do now

Inventory the slug, not a theme screenshot.

# one site
wp plugin get surecart --field=version --path=/home/USER/public_html
wp plugin list --name=surecart --fields=name,status,version --path=/home/USER/public_html

# cPanel box, every account (read-only)
find /home -path '*/wp-content/plugins/surecart/surecart.php' 2>/dev/null \
  | while read -r f; do
      ver=$(awk -F': ' '/^[[:space:]]*\*?[[:space:]]*Version:/{print $2; exit}' "$f")
      echo "$ver  $f"
    done

CNA floor 4.9.6. Ship 4.10.0. The CNA solution line is: update to at least 4.9.6. wordpress.org current is 4.10.0, which also carries the later Patchstack-credited REST and passwordless bullets.[1][5][6]

wp plugin update surecart --path=/home/USER/public_html
wp plugin get surecart --field=version --path=/home/USER/public_html   # want 4.9.6 or later; 4.10.0 is what ships today

If you cannot update today: deactivate. A WAF rule is not a version bump. There is no vendor-named “disable passwordless login only” switch in the changelog we read.[4][5]

wp plugin deactivate surecart --path=/home/USER/public_html

Do not treat the patch as forensic cleanup. 4.9.6 / 4.10.0 stop this bypass. They do not unwind a session that already landed. If you have reason to hunt, dump wp_users / wp_usermeta for unexpected administrators, rotate WordPress salts and SureCart API keys, and invalidate sessions - then keep hunting. We are not claiming you were bypassed.
Unsupported / frozen lines. Patchstack/NVD do not list 4.8.x patched builds. The only unaffected change they published is 4.9.6. Jump a frozen 4.8 site through staging, or remove the plugin.[1][2]

Compromise signs

The published class is auth bypass (C/I/A high). Hunt for, do not treat as proof:[1][2][8]

New WordPress administrators or shop managers you did not create, especially with display names / emails that do not match your staff.
Customer-dashboard or passwordless-login traffic that succeeded without a matching mailbox (if you have mail logs).
REST hits under /wp-json/surecart/ from odd ASNs around 14-22 Oct, if you still have those logs.

Presence of a new admin is a hunt target for any WP incident, not a fingerprint unique to this CVE. Absence is not proof of cleanliness. We did not publish a Nuclei template and we did not send a probe.

FAQ

Is this PHP2Shell? No. PHP2Shell is CVE-2026-109618 / 109619 in PHP itself. This ID is a plugin authentication bug.[1]

Is 4.9.6 enough, or do I need 4.10.0? CNA floor is 4.9.6. 4.10.0 is current on wordpress.org and adds more Patchstack-credited hardening on passwordless login and REST routing. If you can take 4.10.0, take it.[1][5][6]

Is it exploited? CISA SSVC on NVD says exploitation none as of 22 Oct 10:48 UTC. Not on KEV this morning. Tenable EPSS on the page we pulled is 0.00346. None of that is a guarantee it stays quiet.[2][3][7]

Does this give root on the box? The scored scope is unchanged. This is the WordPress / plugin auth boundary, not a claimed KVM or panel root. A stolen WP admin is still a site-takeover.[1][2]

Honesty / What we could not verify

We did not exploit this. No passwordless code was requested. No REST probe. No user was impersonated.
We did not diff 4.9.5 vs 4.9.6 vs 4.10.0 PHP. No mapping of Deva Parekh’s report onto a file or route. Sink location is unverified here.
Changelog credit ≠ CVE mapping. 4.9.6’s passwordless bullet credits Wordfence; 4.10.0’s passwordless and REST bullets credit PatchStack. The CNA still floors this ID at 4.9.6. We are not collapsing those into one bug.[1][4][5]
80,000 is wordpress.org active_installs this morning, not a census we ran.[6]
Not on CISA KEV as of catalog 2026.10.23 / count 1756.[3]
NVD status Deferred; 9.8 is Patchstack Secondary, not an NVD primary metric.[2]

Sources

[1] https://cveawg.mitre.org/api/cve/CVE-2026-112241 [2] https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112241 [3] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json [4] https://plugins.svn.wordpress.org/surecart/tags/4.9.6/readme.txt [5] https://plugins.svn.wordpress.org/surecart/tags/4.10.0/readme.txt [6] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=surecart [7] https://www.tenable.com/cve/CVE-2026-112241 [8] https://patchstack.com/database/wordpress/plugin/surecart/vulnerability/wordpress-surecart-plugin-4-9-5-broken-authentication-vulnerability?_s_id=cve