This vulnerability (CVE-2026-54848) in the APIExperts Square for WooCommerce plugin involves CWE-201, which is the insertion of sensitive information into sent data. This flaw allows attackers to retrieve sensitive data embedded in communications by the plugin. The issue affects all versions up to 4.7.3. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) indicates it is remotely exploitable without authentication or user interaction, with a scope change and impacts on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An attacker can remotely exploit this vulnerability to retrieve sensitive information embedded in data sent by the plugin, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system. Because no privileges or user interaction are required, the risk of exploitation is significant. The scope change indicates that the vulnerability may affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of the affected plugin by restricting network access or disabling the plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.