CVE-2026-106599— WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
Quick assessment
Affected
Brainstorm Force SureCart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Brainstorm Force SureCart 插件中存在“不可信数据反序列化”漏洞，允许进行对象注入。该漏洞影响 SureCart 版本从 n/a 到 4.9.3 的所有版本。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Brainstorm Force | SureCart | ≤ 4.9.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Brainstorm Force | SureCart | 0 ~ 4.9.3 | - |
|
II. Public POCs for CVE-2026-106599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106599
请登录查看更多情报信息。
Other References for CVE-2026-106599 (1)
IV. Related Vulnerabilities
Same product: SureCart
-
CVE-2026-105874
WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (X -
CVE-2026-109697
WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (X -
CVE-2026-97245
WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vu -
CVE-2026-75793
SureCart < 4.7.0 - Unauthenticated Account Creation with Aut -
CVE-2026-18480
SureCart < 4.6.3 - Subscriber+ Administrator Account Takeove
Same vendor: Brainstorm Force
-
CVE-2026-105874
WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (X -
CVE-2026-109697
WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (X -
CVE-2026-108495
WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting -
CVE-2026-39721
WordPress Starter Templates plugin <= 4.7.7 - Broken Access -
CVE-2026-102393
WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scr
Same weakness: CWE-502
-
CVE-2026-110812
Deserialization of untrusted data in the Gremlin graph-impor -
CVE-2026-111094
TeamCity<2026.2远程代码执行漏洞 -
CVE-2026-47168
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserializa -
CVE-2026-109686
WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Inj -
CVE-2026-110761
ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via
V. Comments for CVE-2026-106599
No comments yet