Data Exposure Flaw in SureCart Plugin for WordPress
CVE-2026-108073
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-108073?
The SureCart WordPress plugin prior to version 4.9.5 suffers from a data exposure issue that allows anonymous users to access sensitive information through its REST API. This vulnerability enables unauthenticated visitors to retrieve confidential merchant catalog data, including pricing, commission rates, stock quantities, SKUs, and tax details, as well as information on unpublished products. The lack of access restrictions and improper sanitization of private fields considerably heightens the risk of unauthorized data disclosures.
Affected Version(s)
SureCart 0 < 4.9.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.