---
id: "CVE-2026-120577"
kind: "vulnerability"
aliases: ["CVE-2026-120577"]
title: "FluentCart WordPress plugin: authenticated users can delete arbitrary server files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fluentcart", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-custom-roles", "plugin-not-installed"]
published_at: "2026-11-03T05:18:34+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:49:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120577", "first_seen_at": "2026-11-03T05:48:53+00:00"}]
---

# FluentCart WordPress plugin: authenticated users can delete arbitrary server files

FluentCart, a WordPress eCommerce plugin, fails to validate file paths in its deleteFile function, so it can delete any file on the server. An attacker with custom-level access can delete files such as wp-config.php, which can lead to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FluentCart plugin version in the WordPress admin under Plugins; affected versions are all up to and including `1.6.2`.
- Check whether any user accounts hold custom roles with access to FluentCart admin functions.

## Fix

- FluentCart plugin: a fixed version is not stated in the sources; move past `1.6.2` once the vendor publishes one.

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120577

## From the sources

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_