CVE-2026-108073: SureCart 0 to before 4.9.5

Affected technology

SureCart · 0 to before 4.9.5
Vendor not specified by the source

Description’s affected range: before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API

Component: Not specified by the source

What an attacker can do

The source says the SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.

Published 21-Oct-2026 07:00 UTC

KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-21 07:07:14.882325+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-21 07:00:36.165049+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-108073.html