Aller au contenu
Se connecter
5.3 Moyenne

CVE-2026-108073 The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include…

Description

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.

Produits et versions touchés

Produit Versions touchées Corrigé en
SureCart 4.9 premières → < 4.9.5 4.9.5

Autres CVE de SureCart

Les 3 CVE de SureCart →
CVE-2026-75793 The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating… 6.5 Moyenne CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same… 8.8 Élevée
Suivre cette CVE