CVE-2026-108073: CWE-200 Information Exposure in SureCart

CVE-2026-108073 describes an information exposure vulnerability (CWE-200) in the SureCart WordPress plugin prior to version 4.9.5. The plugin's REST API does not restrict which related objects an unauthenticated visitor may include when accessing a single upsell funnel. Additionally, private fields are not stripped from these objects, allowing unauthenticated users to retrieve sensitive merchant data including pricing, commission, stock levels, SKU, tax details, and unpublished product information.

Unauthenticated attackers can access confidential merchant data that should be restricted, potentially leading to business intelligence leakage and competitive disadvantage. The exposure of unpublished products and internal pricing or commission details could also facilitate further targeted attacks or fraud. There is no indication of active exploitation in the wild.

Upgrade the SureCart plugin to version 4.9.5 or later where this vulnerability is fixed. Since this is a self-hosted plugin, site administrators must apply the update manually. Patch status is not explicitly confirmed in the input data, but the affected versions are clearly stated as before 4.9.5, implying the fix is in 4.9.5 or later.