{"id":"CVE-2026-103525","kind":"vulnerability","aliases":["CVE-2026-103525"],"related":[],"title":"FluentCart WordPress plugin: unauthenticated read of other customers' addresses","description":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.","summary":"Up to and including version 1.7.0, the FluentCart WordPress plugin lets anyone enumerate order and address IDs to read other customers' billing and shipping details. Exposed data includes street address, phone number, company name, VAT number and legal registration ID.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","fluentcart","package","woocommerce-alternative","wordpress"],"not_affected_if":["plugin-updated"],"how_to_check":"- Check the installed FluentCart plugin version in the WordPress admin plugin list or with `wp plugin get fluent-cart --field=version` (plugin slug unknown from sources, confirm it)\n- Look for the 'order_id' and 'billing_address_id' parameters in the plugin's AJAX handlers if you run a custom build","fix":"- Update the FluentCart plugin to a version later than `1.7.0` (exact fixed version unknown from sources)\n- Until patched, restrict access to the plugin's unauthenticated AJAX endpoints at the web server or WAF layer","status":"open","published_at":"2026-10-16T05:17:28+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:20+00:00","updated_at":"2026-10-25T03:25:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:25:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the FluentCart plugin to a version later than `1.7.0` (exact fixed version unknown from sources)\n- Until patched, restrict access to the plugin's unauthenticated AJAX endpoints at the web server or WAF layer","reach":"internet","title":"FluentCart WordPress plugin: unauthenticated read of other customers' addresses","impact":"medium","summary":"Up to and including version 1.7.0, the FluentCart WordPress plugin lets anyone enumerate order and address IDs to read other customers' billing and shipping details. Exposed data includes street address, phone number, company name, VAT number and legal registration ID.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce-alternative","ecommerce","fluentcart"],"confidence":0.8,"needs_auth":"no","worst_case":"Attackers read other customers' addresses, phone numbers and VAT IDs","analyst_note":"Confirm the fixed FluentCart version and the plugin slug from the NVD entry or the vendor changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-103525.","how_to_check":"- Check the installed FluentCart plugin version in the WordPress admin plugin list or with `wp plugin get fluent-cart --field=version` (plugin slug unknown from sources, confirm it)\n- Look for the 'order_id' and 'billing_address_id' parameters in the plugin's AJAX handlers if you run a custom build","needs_analyst":true,"not_affected_if":["plugin-updated"],"who_is_affected":"Sites running FluentCart version 1.7.0 or earlier are exposed, since the flaw sits in an unauthenticated AJAX endpoint that returns stored customer address records. Stores with no FluentCart installed, or with a newer version, are not affected by this entry.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":3539,"output_tokens":671,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103525':12A,15A '-2026':11A,14A '1.7.0':28B,91C '5':194C '60':197C 'address':9A,38B,52B,97C,101C,131C,135C,156C,167C 'ajax':184C 'also':99C 'altern':21B 'anoth':124C 'anyon':34B 'attack':119C,173C 'authent':202C 'auto':152C 'bill':44B,96C,128C 'bypass':170C 'check':205C 'citi':136C 'compani':55B,141C 'compar':179C 'control':111C,174C 'custom':8A,43B,125C 'cve':10A,13A 'data':49B 'detail':47B 'direct':81C 'due':104C 'ecommerc':16B,69C 'entri':185C 'enumer':35B,150C 'equal':162C 'era':67C 'exfiltr':123C 'expos':48B 'faster':70C 'fluentcart':1A,17B,30B,64C 'guard':163C 'halv':176C 'id':39B,62B,95C,98C,102C,148C,157C,161C 'id-equ':160C 'impos':187C 'includ':26B,50B,90C,133C 'increment':153C 'insecur':80C 'intend':164C 'key':112C 'legal':60B,146C 'let':33B 'lighter':71C 'limit':192C 'make':114C 'miss':106C 'name':56B,142C 'new':66C 'number':54B,58B,140C,144C 'object':82C 'order':36B,94C,154C 'ownership':204C 'packag':18B 'pair':158C,180C 'paramet':103C 'per':196C 'phone':53B,139C 'pii':132C 'plugin':3A,32B,74C 'point':186C 'possibl':116C 'postcod':138C 'rate':191C 'rather':199C 'read':5A,41B,121C 'refer':83C 'registr':61B,147C 'request':195C 'restrict':166C 'reus':168C 'second':198C 'sequenti':151C 'ship':46B,100C,130C 'simpler':73C 'soft':190C 'state':137C 'store':127C 'street':51B,134C 'unauthent':4A,118C,183C 'user':110C 'valid':107C 'vat':57B,143C 'version':27B,86C 'via':92C 'vulner':78C 'woocommerc':20B 'woocommerce-altern':19B 'wordpress':2A,22B,31B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running FluentCart version 1.7.0 or earlier are exposed, since the flaw sits in an unauthenticated AJAX endpoint that returns stored customer address records. Stores with no FluentCart installed, or with a newer version, are not affected by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103525","severity":null,"published_at":"2026-10-16T05:17:28+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}