CVE-2026-66463 HIGH

CVE-2026-66463: WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

Vendor Hassan Fakih
Product iCARRY
Weakness CWE-201
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

Explanation of Vulnerability in Simple Terms

02Summary

iCARRY version 2.9 and earlier leaks sensitive information in outbound network traffic. An attacker on the network path can intercept unencrypted data transmissions to read exposed details. No authentication or user interaction is required. Update to a version newer than 2.9 when available.

What an attacker can do

03Attacker Capabilities

Read sensitive information from network traffic sent by the application.

Potential impact on your site

04Site Impact

Sensitive data may be exposed to anyone monitoring network traffic if iCARRY communicates over unencrypted channels.

Conditions required to exploit

05Prerequisites

Network access to intercept traffic between the application and remote servers.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-23546 WordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerability CVE-2026-25339 WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability CVE-2026-39473 WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability CVE-2026-39711 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability CVE-2026-28144 WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability