Live › vulnerability › CVE-2026-103518
Go to dashboardThe FluentCart eCommerce plugin for WordPress does not escape a product variant parameter before using it in a database query, so attacker-chosen input can append extra SQL. An authenticated user with custom-level access or higher can use this to extract sensitive data from the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running FluentCart or FluentCart Pro at version 1.7.0 or earlier where users have accounts with custom-level access or above. The risk is higher on FluentCart Pro sites that assign the Manager shop role to non-administrators, since that role can reach the vulnerable code path. Sites without FluentCart installed, or with only anonymous visitors and no authenticated accounts, are not exposed.
No product ranges from the sources yet.
wp plugin get fluent-cart --field=version1.7.0, as published by the plugin vendor (the exact fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[].variants[].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access.
This page as .md · .json · in your agent: get_signal("CVE-2026-103518")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.