CVE-2026-103525
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The FluentCart plugin for WordPress (versions up to and including 1.7.0) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user-controlled key. An unauthenticated attacker can read and exfiltrate another customer's stored billing and shipping address PII, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.
Risk Assessment
An attacker can enumerate and retrieve PII for all customers, resulting in a major data leak and GDPR violation. The vulnerability is easily exploitable because order and address IDs are sequential and the AJAX endpoint does not require authentication.
Recommendation
Update the FluentCart plugin to a version newer than 1.7.0 as soon as it becomes available. Until then, consider restricting access to the AJAX endpoint or implementing additional authorization checks.
Other vulnerabilities in FluentCart
See all- CVE-2026-109695High
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart (fluent-cart) allows Retrieve Embedded Sensitive Data. This issue affects FluentCart through version 1.7.1.
- CVE-2026-120577High
The FluentCart plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. An authenticated attacker with custom-level access and above can delete arbitrary files on the server.
- CVE-2026-100142Medium
The FluentCart WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
- CVE-2026-103518Medium
The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.
- CVE-2026-14926Medium
The FluentCart WordPress plugin before version 1.4.0 does not verify that a subscription belongs to the requesting customer in several payment-method endpoints. This allows any authenticated customer to act on another customer's subscription (changing payment method, cancelling, or re-binding it) when they know the target subscription identifier.
- CVE-2025-13495Medium
The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database.
Original NVD description (English source)
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS