# SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Unauthenticated Sensitive Information Exposure via Line Items and Checkouts REST Endpoints

- **ID:** WPSEC-2026-0929
- **Plugin:** SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments (`surecart`), https://wordpress.org/plugins/surecart/
- **Affected versions:** all versions before 4.9.5
- **Fixed in:** 4.9.5 (Update to 4.9.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/surecart
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0929/

## Description

The SureCart plugin for WordPress is vulnerable to Sensitive Information Exposure via the line items and checkouts REST API endpoints in all versions up to, and including, 4.9.4. This is due to the guest-accessible line item routes accepting the 'edit' context and returning expanded price and product objects without removing private catalog fields, and to the checkout response filter removing those fields only from directly expanded line items, not from swaps, bumps, upsells, bundle items or variant options. This makes it possible for unauthenticated attackers to extract private store catalog data, such as product download and file details, stock levels, SKUs, metadata, and shipping and tax settings.

## References

- https://wpsec.com/vuln/WPSEC-2026-0929/
- https://plugins.svn.wordpress.org/surecart/tags/4.9.5/
- https://wordpress.org/plugins/surecart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0929/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.