What is the CVSS score of EUVD-2026-57882?

EUVD-2026-57882 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of iCARRY Plugin are affected by EUVD-2026-57882?

The iCARRY WordPress plugin (versions 2.9 and earlier) contains an unauthenticated data exposure vulnerability that allows any remote attacker to extract sensitive information without credentials,…

How to fix or mitigate EUVD-2026-57882?

Within 24 hours: Audit all WordPress installations to identify iCARRY plugin versions 2.9 or earlier using WPScan or Wordfence; document affected systems and associated data sensitivity; contact iCARRY development for patch timeline and interim guidance; brief executive stakeholders on remediation options. Within 7 days: Implement immediate mitigations by disabling the iCARRY plugin if non-critical to business operations, or if required, restrict network access to plugin endpoints using Web Application Firewall rules or IP allowlists; review access logs for indicators of exploitation or unauthorized data retrieval since plugin deployment. Within 30 days: Apply iCARRY vendor patch once released; re-enable the plugin with the updated version; conduct comprehensive forensic analysis of access logs to confirm no sensitive data exfiltration occurred.

iCARRY Plugin EUVD-2026-57882

| CVE-2026-66463 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-13 Patchstack

GHSA-4w5p-p8f5-x7m9

WordPress Information Disclosure Wordpress Plugin Icarry

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated endpoint with no complexity; high confidentiality loss; no integrity or availability impact from read-only data exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:33 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.

Technical ContextAI

iCARRY is a WordPress plugin authored by Hassan Fakih, identified via CPE cpe:2.3:a:hassan_fakih:icarry:*:*:*:*:*:*:*:*. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin transmits data in its responses - likely API endpoints or AJAX handlers - that contains sensitive fields (credentials, tokens, PII, or internal configuration) without adequate access control or filtering. This class of flaw typically arises when WordPress REST API routes, admin-ajax.php actions, or plugin-specific endpoints fail to enforce authentication or capability checks before returning data, or when debug/verbose data is inadvertently included in responses accessible to unauthenticated users. All versions up to and including 2.9 are listed as vulnerable per the NVD CPE wildcard notation.

RemediationAI

Update the iCARRY plugin to a version beyond 2.9 if a patched release has been made available by the vendor; check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/icarry/vulnerability/wordpress-icarry-plugin-2-8-sensitive-data-exposure-vulnerability for the confirmed fixed version, as no exact patch version is independently confirmed in the available data. If no patched version exists, the primary compensating control is to deactivate and uninstall the iCARRY plugin immediately, which eliminates the attack surface entirely with no functional trade-off for sites that can operate without it. If the plugin is operationally required and no patch is available, restrict access to the sensitive endpoints at the web server or WAF layer by blocking or requiring authentication for the specific AJAX action names or REST routes the plugin exposes - note this may break plugin functionality and requires identifying the exact endpoint paths from the plugin source code.