CVE-2026-100143

MediumCVSS 6.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The FluentCart A New Era of eCommerce WordPress plugin before version 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.

Risk Assessment

The risk is that an attacker can take over a guest customer's account, gaining access to their data and order history, potentially leading to privacy breaches and fraud.

Recommendation

It is recommended to update the FluentCart plugin to version 1.6.5 or later, which includes a fix verifying email ownership during guest checkout.

Other vulnerabilities in FluentCart WordPress plugin

CVE-2026-14927Low
The FluentCart WordPress plugin before version 1.5.3 lacks authorization and ownership checks when rendering customer order documents keyed on sequential numeric identifiers. Unauthenticated visitors can enumerate and disclose customer personal data (names, email addresses, billing and shipping addresses, order details) across the store.

Original NVD description (English source)

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS