CVE-2026-100142
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The FluentCart WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
Risk Assessment
Disclosure of customer personal data (addresses, phone numbers, company details) may violate privacy and data protection regulations. It may also undermine trust in the online store.
Recommendation
Update the FluentCart plugin to version 2.2.0 or later. After updating, verify that address selection during checkout is bound to the logged-in customer.
Other vulnerabilities in FluentCart
See all- CVE-2026-109695High
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart (fluent-cart) allows Retrieve Embedded Sensitive Data. This issue affects FluentCart through version 1.7.1.
- CVE-2026-120577High
The FluentCart plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. An authenticated attacker with custom-level access and above can delete arbitrary files on the server.
- CVE-2026-103525High
The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.
- CVE-2026-103518Medium
The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.
- CVE-2026-14926Medium
The FluentCart WordPress plugin before version 1.4.0 does not verify that a subscription belongs to the requesting customer in several payment-method endpoints. This allows any authenticated customer to act on another customer's subscription (changing payment method, cancelling, or re-binding it) when they know the target subscription identifier.
- CVE-2025-13495Medium
The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database.
Original NVD description (English source)
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS