{"id":"CVE-2026-120577","kind":"vulnerability","aliases":["CVE-2026-120577"],"related":[],"title":"FluentCart WordPress plugin: authenticated users can delete arbitrary server files","description":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).","summary":"FluentCart, a WordPress eCommerce plugin, fails to validate file paths in its deleteFile function, so it can delete any file on the server. An attacker with custom-level access can delete files such as wp-config.php, which can lead to remote code execution.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluentcart","package","self-hosted","wordpress"],"not_affected_if":["no-custom-roles","plugin-not-installed"],"how_to_check":"- Check the installed FluentCart plugin version in the WordPress admin under Plugins; affected versions are all up to and including `1.6.2`.\n- Check whether any user accounts hold custom roles with access to FluentCart admin functions.","fix":"- FluentCart plugin: a fixed version is not stated in the sources; move past `1.6.2` once the vendor publishes one.","status":"open","published_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:46+00:00","updated_at":"2026-11-03T05:49:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T05:49:46Z","model":"claude-haiku-5-5","output":{"fix":"- FluentCart plugin: a fixed version is not stated in the sources; move past `1.6.2` once the vendor publishes one.","reach":"internet","title":"FluentCart WordPress plugin: authenticated users can delete arbitrary server files","impact":"high","summary":"FluentCart, a WordPress eCommerce plugin, fails to validate file paths in its deleteFile function, so it can delete any file on the server. An attacker with custom-level access can delete files such as wp-config.php, which can lead to remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fluentcart","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker deletes wp-config.php, enabling remote code execution on the server","analyst_note":"Confirm the fixed FluentCart version and whether custom-level access is a default role, via the NVD entry and the vendor changelog.","how_to_check":"- Check the installed FluentCart plugin version in the WordPress admin under Plugins; affected versions are all up to and including `1.6.2`.\n- Check whether any user accounts hold custom roles with access to FluentCart admin functions.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-custom-roles"],"who_is_affected":"Sites running the FluentCart plugin at version 1.6.2 or earlier are exposed, and the attacker must hold custom-level access or above. Sites without FluentCart, or with only trusted administrators, are less exposed. The sources do not say whether a default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4196,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120577':13A,16A '-2026':12A,15A '1.6.2':103C 'access':52B,115C 'arbitrari':8A,83C,120C 'attack':47B,110C 'authent':4A,109C 'code':64B,131C 'custom':50B,113C 'custom-level':49B,112C 'cve':11A,14A 'delet':7A,40B,54B,85C,119C,138C 'deletefil':35B,94C 'due':86C 'easili':127C 'ecommerc':26B,72C 'era':70C 'execut':65B,132C 'fail':28B 'faster':73C 'file':10A,31B,42B,55B,84C,89C,121C,136C 'fluentcart':1A,17B,23B,67C 'function':36B,95C 'host':21B 'includ':102C 'insuffici':88C 'lead':61B,128C 'level':51B,114C 'lighter':74C 'make':105C 'new':69C 'packag':18B 'path':32B,90C 'plugin':3A,27B,77C 'possibl':107C 'remot':63B,130C 'right':135C 'self':20B 'self-host':19B 'server':9A,45B,124C 'simpler':76C 'user':5A 'valid':30B,91C 'version':98C 'vulner':81C 'wordpress':2A,22B,25B,79C 'wp-config.php':58B,141C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FluentCart plugin at version 1.6.2 or earlier are exposed, and the attacker must hold custom-level access or above. Sites without FluentCart, or with only trusted administrators, are less exposed. The sources do not say whether a default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fluentcart","high","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T05:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120577","severity":null,"published_at":"2026-11-03T05:18:34+00:00","modified_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}