CVE-2026-18480: unknown surecart Improper Privilege Management

Vulnerability summary

CVE-2026-18480 is a high (CVSS 8.8) Improper Privilege Management vulnerability in unknown surecart. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.8% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 4.6.3.

Timeline

1. 06-09-2026
   PublishedVulnerability first disclosed.
2. 06-09-2026
   Last modifiedVulnerability information updated.

Description

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
• CWE-620Unverified Password ChangeWhen setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.