Orta CVSS 5.3
CVE-2026-108073: CVE-2026-108073: hassas bilgi ifşası
Açıklama (NVD)
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
Özet bilgiler
- CVSS v3.1
- 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- %0,33 (yüzdelik 27)
- CWE
- CWE-200
- Yama
- Yok / bilinmiyor