This vulnerability is an information exposure flaw (CWE-200) affecting the REST API of the SureCart plugin for WordPress. The plugin does not restrict the 'expand' query parameter when a single upsell funnel is requested, allowing unauthenticated users to retrieve related objects such as products, taxes, and commissions. The API returns private fields—including pricing, commission details, stock levels, SKU identifiers, tax internal data, and unpublished product information—exposing merchant‑private catalog data that could be used for competitive intelligence or fraudulent activity.

SureCart, a WordPress e‑commerce plugin, is affected in all installations running a pre‑4.9.5 version. Versions 4.9.5 and later contain a fix that enforces access control on the REST endpoint, preventing unauthorized exposure of private catalog data.

The CVSS score is 5.3, and the EPSS score is less than 1%, indicating a very low probability of exploitation. Nevertheless, because any anonymous visitor can trigger the API call by specifying the 'expand' parameter, the threat is readily exploitable without authentication, resulting in a moderate confidentiality risk. While the vulnerability is not listed in the CISA KEV catalog, the practical risk remains significant due to the ease of discovery with standard API testing tools.