CVE-2026-103518
MediumCVSS 4.9Summary
The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.
Risk Assessment
Potential database data leakage, including customer and order information. On FluentCart Pro installs, the vulnerability can be exploited by a non-administrator user.
Recommendation
Update the plugin to a version later than 1.7.0. Restrict the products/edit permission and review database logs for unusual queries.
Other vulnerabilities in FluentCart
See all- CVE-2026-103525High
The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.
- CVE-2026-109695High
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart (fluent-cart) allows Retrieve Embedded Sensitive Data. This issue affects FluentCart through version 1.7.1.
- CVE-2026-14926Medium
The FluentCart WordPress plugin before version 1.4.0 does not verify that a subscription belongs to the requesting customer in several payment-method endpoints. This allows any authenticated customer to act on another customer's subscription (changing payment method, cancelling, or re-binding it) when they know the target subscription identifier.
Original NVD description (English source)
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS