What is the CVSS score of CVE-2026-54848?

CVE-2026-54848 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of APIExperts Square are affected by CVE-2026-54848?

The APIExperts Square for WooCommerce plugin (woosquare) versions through 4.7.3 contains an unauthenticated sensitive data exposure vulnerability (CVSS 8.3) allowing remote attackers to retrieve…

How to fix or mitigate CVE-2026-54848?

24 hours: Inventory all WooCommerce instances running woosquare plugin version 4.7.3 or earlier; document data sensitivity and customer impact scope. 7 days: Implement interim mitigations (disable plugin if non-critical, deploy WAF rules); conduct forensic audit to identify potential data exposure window and affected customer records. 30 days: Establish continuous monitoring for vendor security advisory and patched version release; prepare and test customer notification and incident response procedures.

APIExperts Square CVE-2026-54848

EUVD-2026-39393 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-25 Patchstack

GHSA-2frh-gc5f-r5qj

WordPress Information Disclosure Wordpress Plugin Apiexperts Square For Woocommerce Saad Iqbal

8.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

5.3 MEDIUM

Unauthenticated network access with no interaction (AV:N/AC:L/PR:N/UI:N); a pure CWE-201 data leak affects confidentiality only (C:L), with no demonstrated integrity/availability impact or cross-system scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:27 vuln.today

CVE Published

Jun 25, 2026 - 13:26 cve.org

HIGH 8.3

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data.

This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 1 Critical, 6 High, 2 With POC Jun 26, 2026

AnalysisAI

Sensitive data exposure in the APIExperts Square for WooCommerce WordPress plugin (also known as woosquare) through version 4.7.3 allows remote attackers to retrieve embedded sensitive information that the plugin inserts into data it sends. Reported by Patchstack and rated CVSS 8.3, the flaw stems from CWE-201 (Insertion of Sensitive Information Into Sent Data) and is exploitable without authentication or user interaction per its CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is woosquare, a WordPress/WooCommerce plugin by Saad Iqbal that integrates the Square payment gateway and catalog/inventory syncing into WooCommerce storefronts, identified by CPE cpe:2.3:a:saad_iqbal:apiexperts_square_for_woocommerce. The root cause is CWE-201, Insertion of Sensitive Information Into Sent Data, meaning the application embeds sensitive values (potentially API keys, tokens, customer/order data, or Square credentials) into output or responses that are transmitted to a recipient who is not authorized to see them. In a WordPress plugin context this class of bug commonly arises when an AJAX endpoint, REST route, or generated page response includes secrets or PII that should have been filtered, scoped, or omitted before transmission.

RemediationAI

No vendor-released patch version is identified in the available data; since 4.7.3 is the last affected version, administrators should upgrade to the next release published after 4.7.3 once confirmed by the vendor or Patchstack, verifying the exact fixed version on the advisory at https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-7-3-sensitive-data-exposure-vulnerability?_s_id=cve before relying on it. Until a confirmed fix is applied, restrict reachability of the plugin's endpoints by placing a WAF rule or virtual patch (Patchstack offers one) in front of the affected AJAX/REST routes, and limit exposure of the storefront's admin and integration endpoints to trusted networks where feasible. If the Square integration is non-essential, deactivating the woosquare plugin removes the exposure entirely at the cost of losing Square payment/catalog syncing; rotating any Square API credentials that may have been exposed is also prudent since leaked secrets remain valid until rotated.