CVE-2026-108073
Deferred Deferred - Pending Action

Unauthenticated Data Exposure in SureCart WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-108073
EUVD
EUVD-2026-107065

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SureCart 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the SureCart WordPress plugin before version 4.9.5 allows unauthenticated users to access private merchant catalog data through its REST API. The issue stems from insufficient restrictions on the 'expand' parameter, enabling anonymous visitors to include related objects and view sensitive information such as pricing, commission rates, stock levels, SKUs, tax details, and even unpublished products.

Detection Guidance

To detect this vulnerability, check if your SureCart plugin version is prior to 4.9.5. You can use WordPress commands like 'wp plugin list' or check the plugin version in the WordPress admin panel. Additionally, monitor REST API requests for unusual 'expand' parameter usage that may expose private data.

Impact Analysis

This vulnerability could expose sensitive business data like pricing, stock levels, and tax details to unauthorized users. Merchants using the plugin may face data leaks, financial information exposure, or competitive disadvantages if unpublished products or internal pricing structures are accessed.

Compliance Impact

This vulnerability may lead to non-compliance with GDPR or other privacy regulations due to unauthorized access to sensitive merchant data. GDPR requires protection of personal and financial data, and this flaw could result in data breaches, triggering reporting obligations and potential fines.

Mitigation Strategies

Immediately update the SureCart plugin to version 4.9.5 or later to patch the vulnerability. If updating is not possible, consider temporarily disabling the plugin until an update is applied. Review API logs for unauthorized access attempts and restrict access to sensitive endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108073. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...