CVE-2026-75793

SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.

Affected

SureCart

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 19th percentile

Published

2026-09-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d1c2ea43-2643-4cdf-8dfe-e11109266f51/

References

• CVE Record
• NVD entry