CVE-2026-66463 - Vulnerability Details

Description

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

Published: 2026-08-13

Score: 7.5 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

Unauthenticated vulnerabilities in the iCARRY plugin up to version 2.9 allow attackers to read sensitive information without authentication, resulting in a confidentiality breach. The flaw is identified as CWE-201, representing a flaw that permits disclosure of confidential information.

Affected Systems

The vulnerability affects the iCARRY WordPress plugin, developed by Hassan Fakih, for all installed versions 2.9 and older. Users running these versions on any WordPress site are potentially exposed.

Risk and Exploitability

The CVSS score of 7.5 classifies the weakness as high. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote and unauthenticated, as the flaw permits information disclosure without credentials, making it exploitable by any actor who can reach the site.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Hassan Fakih

iCARRY

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 2.9

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the iCARRY plugin to the latest available version that removes the sensitive data exposure flaw
If an upgrade is not immediately possible, disable or uninstall the iCARRY plugin to eliminate the exposed path
Ensure the WordPress core and other plugins are kept current and monitor the plugin’s vendor for any further advisories

Generated by OpenCVE AI on August 13, 2026 at 16:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/icarry/vulnerability/wordpress-icarry-plugin-2-8-sensitive-data-exposure-vulnerability?_s_id=cve

History

Thu, 13 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 13 Aug 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
Title		WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability
Weaknesses		CWE-201
References		https://patchstack.com/database/wordpress/plugin/icarry/vulnerability/wordpress-icarry-plugin-2-8-sensitive-data-exposure-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2026-08-13T13:37:03.342Z

Updated: 2026-08-13T15:29:32.291Z

Reserved: 2026-07-27T09:00:34.597Z

Link: CVE-2026-66463

Vulnrichment

Updated: 2026-08-13T15:29:27.107Z

NVD

Status : Received

Published: 2026-08-13T14:17:07.580

Modified: 2026-08-13T16:18:44.783

Link: CVE-2026-66463

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-13T16:30:03Z

Weaknesses

CWE-201
Insertion of Sensitive Information Into Sent Data

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66463", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-07-27T09:00:34.597Z", "datePublished": "2026-08-13T13:37:03.342Z", "dateUpdated": "2026-08-13T15:29:32.291Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-08-13T13:37:03.342Z"}, "title": "WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "Hassan Fakih", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "icarry", "product": "iCARRY", "versions": [{"lessThanOrEqual": "2.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions."}], "value": "Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/icarry/vulnerability/wordpress-icarry-plugin-2-8-sensitive-data-exposure-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T14:59:21.465893Z", "id": "CVE-2026-66463", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:29:32.291Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66463", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-07-27T09:00:34.597Z", "datePublished": "2026-08-13T13:37:03.342Z", "dateUpdated": "2026-08-13T15:29:32.291Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-08-13T13:37:03.342Z"}, "title": "WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "Hassan Fakih", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "icarry", "product": "iCARRY", "versions": [{"lessThanOrEqual": "2.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions."}], "value": "Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/icarry/vulnerability/wordpress-icarry-plugin-2-8-sensitive-data-exposure-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66463", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:59:21.465893Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:29:27.107Z"}}]}}

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object