CVE-2026-75793
The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled.
- Published Sep 6, 2026
- CVSS 6.5 medium
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available