CVE-2026-120574

#NØØT Security Alerts 🚨 #ALERT — SureCart Passwordless Login Flaw Enables Conditional WordPress Admin Account Takeover October 30, 2026

PRODUCT: SureCart WordPress e-commerce plugin. CVE: CVE-2026-120574 | HIGH (CVSS 3.1: 8.1).

AFFECTED: Versions ≤4.9.5. FIRST FIX: 4.9.6 (October 16). LATEST VERIFIED: 4.12.0 (November 3), with further passwordless-login hardening.

IMPACT: An unauthenticated attacker can request a six-digit login code for a targeted account, including an administrator. Missing per-account attempt limits in affected versions permit guessing across rotating IPs. A successfully guessed valid code can establish a session as that user.

EXPLOITATION STATUS: Wordfence-documented vulnerability. No confirmed malicious exploitation established in the cited sources. The CVE record was published November 3; that was not the original patch date.

TRIAGE: Correlate login-code requests and repeated verification failures across IPs; investigate unexpected admin sessions or account changes. These signals are not conclusive IoCs.

URGENT ACTION: Back up and test, then upgrade to verified SureCart 4.12.0 or a newer fixed release. Confirm the running version. If updating is delayed, restrict exposed login routes using tested controls. Preserve evidence on suspected compromised sites, terminate unauthorized sessions and investigate persistence. Patching alone cannot revoke existing sessions.

SOURCES: https://t.co/bAVHo5zkUp

CONFIDENCE: HIGH for Wordfence’s vulnerability findings and vendor release history; LIMITED for real-world exploitation.

#CyberSecurity #WordPress #AppSec #CVE #InfoSec #IncidentResponse #VulnerabilityManagement #ThreatIntel