---
id: "CVE-2026-103525"
kind: "vulnerability"
aliases: ["CVE-2026-103525"]
title: "FluentCart WordPress plugin: unauthenticated read of other customers' addresses"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "fluentcart", "package", "woocommerce-alternative", "wordpress"]
not_affected_if: ["plugin-updated"]
published_at: "2026-10-16T05:17:28+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:25:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103525", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# FluentCart WordPress plugin: unauthenticated read of other customers' addresses

Up to and including version 1.7.0, the FluentCart WordPress plugin lets anyone enumerate order and address IDs to read other customers' billing and shipping details. Exposed data includes street address, phone number, company name, VAT number and legal registration ID.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FluentCart plugin version in the WordPress admin plugin list or with `wp plugin get fluent-cart --field=version` (plugin slug unknown from sources, confirm it)
- Look for the 'order_id' and 'billing_address_id' parameters in the plugin's AJAX handlers if you run a custom build

## Fix

- Update the FluentCart plugin to a version later than `1.7.0` (exact fixed version unknown from sources)
- Until patched, restrict access to the plugin's unauthenticated AJAX endpoints at the web server or WAF layer

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103525

## From the sources

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_