{"id":"CVE-2026-100142","kind":"vulnerability","aliases":["CVE-2026-100142"],"related":[],"title":"FluentCart WordPress plugin lets anyone read stored customer addresses","description":"The FluentCart A New Era of eCommerce  WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.","summary":"The FluentCart eCommerce WordPress plugin before 2.2.0 does not check that a stored customer address chosen at checkout belongs to the person placing the order. An unauthenticated attacker can attach another customer's address to their own order and read it back, exposing postal addresses, phone numbers and company details.","severity":"medium","cvss":5.3,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","self-hosted","woocommerce-alternative","wordpress"],"not_affected_if":["fluent-cart-2.2.0-or-later"],"how_to_check":"- Check the installed FluentCart version in the WordPress plugins screen or `wp plugin get fluent-cart --field=version` (unknown if the plugin slug differs)\n- Confirm whether the checkout address selection is in use on the store","fix":"- Update FluentCart to `2.2.0` or later\n- unknown for any interim workaround","status":"open","published_at":"2026-10-22T06:17:12+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:33+00:00","updated_at":"2026-10-25T04:20:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update FluentCart to `2.2.0` or later\n- unknown for any interim workaround","reach":"internet","title":"FluentCart WordPress plugin lets anyone read stored customer addresses","impact":"medium","summary":"The FluentCart eCommerce WordPress plugin before 2.2.0 does not check that a stored customer address chosen at checkout belongs to the person placing the order. An unauthenticated attacker can attach another customer's address to their own order and read it back, exposing postal addresses, phone numbers and company details.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce-alternative","ecommerce","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Customer postal addresses, phone numbers and company details readable by strangers","analyst_note":"","how_to_check":"- Check the installed FluentCart version in the WordPress plugins screen or `wp plugin get fluent-cart --field=version` (unknown if the plugin slug differs)\n- Confirm whether the checkout address selection is in use on the store","needs_analyst":false,"not_affected_if":["fluent-cart-2.2.0-or-later"],"who_is_affected":"Sites running the FluentCart plugin before 2.2.0 that accept checkout with stored customer addresses are exposed, since the flaw sits in that address lookup path. Stores on a version 2.2.0 or newer, or sites without the plugin, can skip it. The sources do not say whether the default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3374,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100142':12A,15A '-2026':11A,14A '2.2.0':31B,85C 'address':9A,39B,58B,69B,93C,110C,123C 'allow':101C 'altern':23B 'anoth':55B 'anyon':5A 'attach':54B,105C 'attack':52B,103C 'back':66B,119C 'belong':43B,97C 'check':34B 'checkout':42B,96C 'chosen':40B 'compani':73B,127C 'custom':8A,38B,56B,92C,107C,121C 'cve':10A,13A 'detail':74B,128C 'disclos':120C 'ecommerc':16B,27B,81C 'era':79C 'expos':67B 'fluentcart':1A,26B,76C 'host':20B 'let':4A 'new':78C 'number':71B,125C 'order':49B,62B,113C 'packag':17B 'person':46B 'phone':70B,124C 'place':47B,115C 'plugin':3A,29B,83C 'postal':68B,122C 'read':6A,64B,117C 'request':100C 'select':94C 'self':19B 'self-host':18B 'store':7A,37B,91C,109C 'unauthent':51B,102C 'verifi':88C 'woocommerc':22B 'woocommerce-altern':21B 'wordpress':2A,24B,28B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FluentCart plugin before 2.2.0 that accept checkout with stored customer addresses are exposed, since the flaw sits in that address lookup path. Stores on a version 2.2.0 or newer, or sites without the plugin, can skip it. The sources do not say whether the default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100142","severity":null,"published_at":"2026-10-22T06:17:12+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-100142","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100142","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}