Skip to content
Sign in
5.3 Medium

CVE-2026-108073 The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include…

Description

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.

Affected products and versions

Product Affected versions Fixed in
SureCart 4.9 earliest → < 4.9.5 4.9.5

Other CVEs of SureCart

The 3 CVEs of SureCart →
CVE-2026-75793 The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating… 6.5 Medium CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same… 8.8 High
Track this CVE