CVE-2026-108073: SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

Q: Which versions require remediation?

SureCart WordPress plugin versions earlier than 4.9.5 are affected.

Q: Does exploitation require a WordPress account or other authentication?

No. An unauthenticated visitor can exploit the issue through the REST API when reading a single upsell funnel and using the expand parameter to include related objects.

Published Oct 21, 2026

Updated

The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.

Affected Software

1 affected component

SureCart SureCart WordPress plugin<4.9.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SureCart WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.9.5

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which versions require remediation?

SureCart WordPress plugin versions earlier than 4.9.5 are affected.

Does exploitation require a WordPress account or other authentication?

No. An unauthenticated visitor can exploit the issue through the REST API when reading a single upsell funnel and using the expand parameter to include related objects.