Live › vulnerability › CVE-2026-108073
Go to dashboardThe SureCart WordPress plugin before 4.9.5 lets an anonymous visitor read a single upsell funnel through its REST API and include related objects that should be private. Those objects expose merchant-private fields such as pricing, commission, stock, SKU, tax details and unpublished products.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SureCart plugin older than that expose its REST API to anonymous visitors are affected, which is the default for a public storefront. The sources do not say whether a non-default setting changes exposure. Sites not running SureCart can skip this.
4.9.5No product ranges from the sources yet.
wp plugin get surecart --field=version4.9.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
This page as .md · .json · in your agent: get_signal("CVE-2026-108073")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.