WordPress plugin vulnerabilities: 6 plugins affected, including SureCart

Vulnerabilities have been disclosed in six WordPress plugins. The most serious affect Ultra Addons for Contact Form 7 and s2Member, both rated CVSS 9.8. The most widely used affected plugin is SureCart, with about 80,000 active installations, where unauthenticated attackers can take over administrator accounts. None of these vulnerabilities is reported as actively exploited so far. Check every site you manage for these plugins.

Ultra Addons for Contact Form 7 (60,000 active installations)

Unauthenticated attackers can delete arbitrary files on the server because of insufficient file path validation in the _getObjAttr function. Deleting a file such as wp-config.php can lead to remote code execution. The flaw can only be exploited when the PDF Generator add-on is active and a Contact Form 7 form is configured for PDF generation. All versions up to and including 3.5.54 are affected (CVE-2026-102435, CVSS 9.8); update to the latest version, or deactivate and remove the plugin if no update is available.

s2Member (8,000 active installations)

The plugin is vulnerable to remote code execution through the item_name parameter, due to insufficient sanitization in strip_php_tags_deep(). Authenticated attackers with custom-level access and above can execute code on the server. All versions up to and including 260927 are affected (CVE-2026-86596, CVSS 9.8). Update to the latest version, or deactivate and remove the plugin if no update is available.

SureCart (80,000 active installations)

The passwordless one-time-code login has no attempt counter, lockout or rate limit and also works for high-privilege accounts. An unauthenticated attacker can request a code for any user, including an administrator, and brute-force the 6-digit code to obtain a session as that user. All versions up to and including 4.9.5 are affected (CVE-2026-120574, CVSS 8.1). Update to the latest version, or deactivate and remove the plugin if no update is available.

Easy Digital Downloads (40,000 active installations)

An authentication bypass in the PayPal guest checkout lets an unauthenticated attacker who uses an administrator's email address, where that administrator has no existing EDD customer record, receive an authenticated session as that administrator after completing the PayPal purchase flow. The standard PayPal checkout and the REST UnbrandedCard and Fastlane flows are affected. All versions up to and including 3.7.2 are vulnerable (CVE-2026-120538, CVSS 8.1); update to the latest version, or deactivate and remove the plugin if no update is available.

FluentCart (9,000 active installations)

Insufficient file path validation in the deleteFile function allows authenticated attackers with custom-level access and above to delete arbitrary files on the server. Deleting a file such as wp-config.php can lead to remote code execution. All versions up to and including 1.6.2 are affected (CVE-2026-120577, CVSS 8.1). Update to the latest version, or deactivate and remove the plugin if no update is available.

Advanced Shipment Tracking for WooCommerce (70,000 active installations)

The tracking_provider parameter of the shipment-trackings REST endpoint is vulnerable to SQL injection because the value is concatenated directly into the query. Authenticated attackers with Shop Manager-level access and above can use it to extract sensitive information from the database. All versions up to and including 3.9 are affected (CVE-2026-120558, CVSS 7.2). Update to the latest version, or deactivate and remove the plugin if no update is available.

How to check your sites

In the WordPress dashboard, open Plugins > Installed Plugins and look for the plugins listed above and their version numbers. With WP-CLI, run wp plugin list to see all installed plugins with their versions and available updates, and wp plugin update <plugin-slug> to update a single plugin. After updating, confirm that the new version is active, and remove any affected plugin that is no longer needed.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-102435
• https://nvd.nist.gov/vuln/detail/CVE-2026-120538