SureCart < 4.3.0 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook

Description

The plugin is vulnerable to privilege escalation via account takeover. This is due to the plugin not properly validating a user's identity prior to updating their details such as email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change a linked user's email address — including administrators, if the administrator account is linked to a SureCart customer record — and leverage that to reset the user's password and gain access to their account if the customer ID is known.