SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Sensitive Information Exposure via Line Items and Checkouts REST Endpoints
- ID
- WPSEC-2026-0929
- Plugin
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (surecart)
- Affected
- all versions before 4.9.5
- Remediation
- Update to 4.9.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments on WPSec AttackSurface
- Fix released
- Published
Description
The SureCart plugin for WordPress is vulnerable to Sensitive Information Exposure via the line items and checkouts REST API endpoints in all versions up to, and including, 4.9.4. This is due to the guest-accessible line item routes accepting the 'edit' context and returning expanded price and product objects without removing private catalog fields, and to the checkout response filter removing those fields only from directly expanded line items, not from swaps, bumps, upsells, bundle items or variant options. This makes it possible for unauthenticated attackers to extract private store catalog data, such as product download and file details, stock levels, SKUs, metadata, and shipping and tax settings.
References
- https://wpsec.com/vuln/WPSEC-2026-0929/
- https://plugins.svn.wordpress.org/surecart/tags/4.9.5/
- https://wordpress.org/plugins/surecart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS