APIExperts Square EUVD-2026-39393

Exploitation requires that the target WordPress site has the APIExperts Square for WooCommerce (woosquare) plugin installed and active at version 4.7.3 or earlier with the Square integration in use. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required and the affected endpoint is reachable over the network, so against a vulnerable installation no special configuration is stated as necessary. The principal limiting factor is the narrow prerequisite that this specific plugin be deployed and enabled; the actual sensitivity of leaked data depends on what the site has configured (e.g., active Square credentials or stored order data), which the description does not enumerate.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated flaw with changed scope and Low confidentiality, integrity, and availability impacts, yielding 8.3. The score is elevated primarily by the unauthenticated network vector and scope change rather than by deep impact, since each CIA impact is only Low - for a pure information-disclosure (CWE-201) issue the integrity and availability Low ratings are debatable and likely reflect downstream effects of leaked data rather than direct write/DoS capability. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV and POC suggests no confirmed active exploitation. Real-world priority is moderate: easy unauthenticated access raises concern, but the narrow plugin footprint and Low impact metrics temper urgency. Note the vector's S:C/I:L/A:L for what is described purely as data retrieval should be verified against the vendor advisory, as it may overstate non-confidentiality impact.

A remote, unauthenticated attacker sends a crafted HTTP request to a WooCommerce site running the woosquare plugin and receives a response that embeds sensitive information the plugin should not have disclosed, such as configuration secrets or order/customer data. The low attack complexity and lack of required privileges or user interaction make this trivially repeatable, though no public exploit code is identified at time of analysis.