CVE-2026-106599
8.8HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Authenticated attackers with low-privilege accounts can achieve remote code execution or tamper with database records via PHP object injection. They only need valid user credentials to submit payloads over the network.
Root cause
The plugin unsafely deserializes user-supplied input, allowing arbitrary PHP object instantiation and property tampering.
Affected systems
Brainstorm Force SureCart through 4.9.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade SureCart to a version newer than 4.9.3 once available. If patching must wait, disable the SureCart plugin or restrict WordPress user registration and login access.
$ wp plugin update surecartAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.