# CVE-2026-54848: Saad Iqbal APIExperts Square for WooCommerce sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-54848-saad-iqbal-apiexperts-square-for-woocommerce-sensitive-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54848 · Severity: high · CVSS 8.3 · Published 2026-06-25

The APIExperts Square for WooCommerce plugin, which integrates Square payment processing with WordPress online stores, contains a security flaw that exposes sensitive information. An unauthorized attacker can access data that should be private, potentially leading to further compromise of the store or customer information. This vulnerability could be used in automated attacks against thousands of websites simultaneously.

Technologies: [APIExperts Square for WooCommerce](https://junglewise.ai/threats/technologies/square-for-woocommerce). Vendors: [APIExperts](https://junglewise.ai/threats/vendors/apiexperts).

## Quick answers

**Is CVE-2026-54848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54848 being exploited in the wild.

**How severe is CVE-2026-54848?** High severity, with a CVSS score of 8.3, published 25 June 2026.

**Which products and versions are affected?** APIExperts Square for WooCommerce up to 4.7.3.

**Is there a fix for CVE-2026-54848?** A patch was published on 2026-06-25: Version 4.7.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54848 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54848?** Check whether you run APIExperts Square for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The APIExperts Square for WooCommerce plugin (versions up to 4.7.3) is vulnerable to CWE-201: Insertion of Sensitive Information Into Sent Data. This flaw allows an unauthenticated remote attacker to retrieve sensitive data that is inadvertently embedded in the data sent by the application. The vulnerability has a CVSS 3.1 score of 8.3, reflecting its high impact and ease of exploitation over the network without user interaction. Attackers can leverage this exposed information to facilitate further attacks or gain unauthorized insights into the system's configuration or user data. A fix is available in version 4.7.4.

## Affected products

- Saad Iqbal APIExperts Square for WooCommerce up to 4.7.3

## Timeline

- 2026-04-29: other: Vulnerability reported by Peng Zhou
- 2026-06-18: advisory: Patchstack published advisory
- 2026-06-25: disclosed: CVE published to NVD
- 2026-06-25: patched: Version 4.7.4 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-7-3-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-7-3-sensitive-data-exposure-vulnerability?_s_id=cve)

## Related threats

- [Saad Iqbal APIExperts Square for WooCommerce SQL injection](https://junglewise.ai/threats/cve-2026-57810-saad-iqbal-apiexperts-square-for-woocommerce-sql-injection)
- [Saad Iqbal APIExperts Square for WooCommerce SQL injection](https://junglewise.ai/threats/cve-2026-45211-saad-iqbal-apiexperts-square-for-woocommerce-sql-injection)