CyberRota Analysis
AI-GeneratedThe SureCart WordPress plugin prior to version 4.6.3 is vulnerable, allowing users with subscriber-level permissions to change email addresses of other users, including administrators, facilitating account takeovers through password resets. Additionally, it enables the association of attacker-controlled customer records with arbitrary users and exposes customer identifiers and email addresses to any authenticated user. WordPress site administrators and users of the SureCart plugin should prioritize updating to mitigate these significant security risks.
Original NVD Description
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.