Live › vulnerability › CVE-2026-103525
Go to dashboardUp to and including version 1.7.0, the FluentCart WordPress plugin lets anyone enumerate order and address IDs to read other customers' billing and shipping details. Exposed data includes street address, phone number, company name, VAT number and legal registration ID.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running FluentCart version 1.7.0 or earlier are exposed, since the flaw sits in an unauthenticated AJAX endpoint that returns stored customer address records. Stores with no FluentCart installed, or with a newer version, are not affected by this entry.
No product ranges from the sources yet.
wp plugin get fluent-cart --field=version (plugin slug unknown from sources, confirm it)1.7.0 (exact fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
This page as .md · .json · in your agent: get_signal("CVE-2026-103525")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.