Executive Summary
A critical authentication bypass has been disclosed in SureCart, the WordPress e-commerce plugin from Brainstorm Force. Tracked as CVE-2026-112241 (CVSS 9.8), the flaw is classified as Authentication Bypass by Spoofing (CWE-290) and affects all versions through 4.9.5.
The CVE was assigned by Patchstack, reserved on 2026-10-19 and published on 2026-10-22. NVD analysis is still pending.
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-112241 |
| CVSS v3.1 | 9.8 (Critical) |
| Weakness | CWE-290 — Authentication Bypass by Spoofing |
| Attack vector | Network, low complexity |
| Privileges / user interaction | None required |
| Affected versions | SureCart ≤ 4.9.5 |
| Fixed version | 4.9.6 or later |
Public detail is thin. The record describes the issue only as "Authentication Abuse" through spoofing, and the exact vulnerable code path has not been published in the sources reviewed. Treat any third-party write-ups that go further with caution until the Patchstack advisory is fully available.
Exploitation Status
No source reviewed lists the flaw as exploited in the wild, and it is not in the CISA KEV catalog at the time of writing. Because the attack needs no authentication and no user interaction, WordPress plugin flaws of this class tend to be scanned for quickly after disclosure.
SureCart 4.9.5 and earlier are also affected by two stored cross-site scripting issues, CVE-2026-112221 and CVE-2026-112840.
Remediation
- Update SureCart to 4.9.6 or later on every WordPress site you manage.
- Review administrator and customer accounts for unexpected additions or recent logins.
- Review order and customer records for tampering on stores running affected versions.
- If you cannot patch immediately, deactivate the plugin or restrict access to the site with a WAF until you can.