CVE-2026-14927
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The FluentCart WordPress plugin before version 1.5.3 lacks authorization and ownership checks when rendering customer order documents keyed on sequential numeric identifiers. Unauthenticated visitors can enumerate and disclose customer personal data (names, email addresses, billing and shipping addresses, order details) across the store.
Risk Assessment
Massive leakage of customer personal data occurs, potentially leading to privacy breaches and legal consequences.
Recommendation
Update the FluentCart plugin to version 1.5.3 or later, which includes access controls for order documents.
Original NVD description (English source)
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.