---
id: "CVE-2026-100142"
kind: "vulnerability"
aliases: ["CVE-2026-100142"]
title: "FluentCart WordPress plugin lets anyone read stored customer addresses"
severity: "medium"
cvss: 5.3
epss: 0.00235
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "self-hosted", "woocommerce-alternative", "wordpress"]
not_affected_if: ["fluent-cart-2.2.0-or-later"]
published_at: "2026-10-22T06:17:12+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100142", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-100142", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# FluentCart WordPress plugin lets anyone read stored customer addresses

The FluentCart eCommerce WordPress plugin before 2.2.0 does not check that a stored customer address chosen at checkout belongs to the person placing the order. An unauthenticated attacker can attach another customer's address to their own order and read it back, exposing postal addresses, phone numbers and company details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FluentCart version in the WordPress plugins screen or `wp plugin get fluent-cart --field=version` (unknown if the plugin slug differs)
- Confirm whether the checkout address selection is in use on the store

## Fix

- Update FluentCart to `2.2.0` or later
- unknown for any interim workaround

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100142
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-100142

## From the sources

The FluentCart A New Era of eCommerce  WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_