Live › vulnerability › CVE-2026-100142
Go to dashboardThe FluentCart eCommerce WordPress plugin before 2.2.0 does not check that a stored customer address chosen at checkout belongs to the person placing the order. An unauthenticated attacker can attach another customer's address to their own order and read it back, exposing postal addresses, phone numbers and company details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the FluentCart plugin before 2.2.0 that accept checkout with stored customer addresses are exposed, since the flaw sits in that address lookup path. Stores on a version 2.2.0 or newer, or sites without the plugin, can skip it. The sources do not say whether the default configuration is affected.
No product ranges from the sources yet.
wp plugin get fluent-cart --field=version (unknown if the plugin slug differs)2.2.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
This page as .md · .json · in your agent: get_signal("CVE-2026-100142")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.