CVE-2025-13495
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database.
Risk Assessment
An attacker can access sensitive data from the WordPress database, potentially leading to information disclosure. However, this requires Administrator-level privileges.
Recommendation
Update the plugin to a version later than 1.3.1. Restrict administrator privileges and check for unauthorized access.
Other vulnerabilities in FluentCart
See all- CVE-2026-109695High
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart (fluent-cart) allows Retrieve Embedded Sensitive Data. This issue affects FluentCart through version 1.7.1.
- CVE-2026-120577High
The FluentCart plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. An authenticated attacker with custom-level access and above can delete arbitrary files on the server.
- CVE-2026-100142Medium
The FluentCart WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
- CVE-2026-103525High
The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.
- CVE-2026-103518Medium
The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.
- CVE-2026-14926Medium
The FluentCart WordPress plugin before version 1.4.0 does not verify that a subscription belongs to the requesting customer in several payment-method endpoints. This allows any authenticated customer to act on another customer's subscription (changing payment method, cancelling, or re-binding it) when they know the target subscription identifier.
Original NVD description (English source)
The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS