{
 "id": "WPSEC-2026-0929",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0929/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0929/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0929/index.md",
 "title": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Sensitive Information Exposure via Line Items and Checkouts REST Endpoints",
 "description": "The SureCart plugin for WordPress is vulnerable to Sensitive Information Exposure via the line items and checkouts REST API endpoints in all versions up to, and including, 4.9.4. This is due to the guest-accessible line item routes accepting the 'edit' context and returning expanded price and product objects without removing private catalog fields, and to the checkout response filter removing those fields only from directly expanded line items, not from swaps, bumps, upsells, bundle items or variant options. This makes it possible for unauthenticated attackers to extract private store catalog data, such as product download and file details, stock levels, SKUs, metadata, and shipping and tax settings.",
 "plugin": {
  "slug": "surecart",
  "name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
  "wordpress_org": "https://wordpress.org/plugins/surecart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.9.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.9.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.9.5",
 "remediation": "Update to 4.9.5 or later.",
 "fix_released": "2026-10-12T18:00:39+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:48.328948+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0929/",
  "https://plugins.svn.wordpress.org/surecart/tags/4.9.5/",
  "https://wordpress.org/plugins/surecart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}