Moyenne
5.3
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous...
CVE-2026-108073
Première détection SecPulse
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| CVE | SureCart |
< 4.9.5 |
4.9.5 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Références
- web nvd.nist.gov
- web wpscan.com
- web github.com
- web contact@wpscan.com