FluentCart CVE-2026-100143

Exploitable remotely without authentication against the guest-checkout flow of any FluentCart install before 1.6.5, but only when the attacker already knows the email address of an existing guest customer - that prior knowledge is the key limiting factor. The store must support guest (non-registered) checkout, which is the typical eCommerce default. No user interaction from the victim and no elevated privileges are required; impact is limited to the specific customer whose email is known, and only that customer's stored record and account are exposed per successful attempt.

This is a genuine but moderate-priority authentication/account-takeover flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) indicates fully remote, unauthenticated, no-user-interaction exploitation, which raises baseline concern. However, the real-world risk is tempered by a hard prerequisite embedded in the description: the attacker must already know an existing guest customer's email address, and impact is capped at partial confidentiality and integrity (C:L/I:L) with no availability effect. Signals are internally consistent: SSVC scores Exploitation as 'none' (no observed exploitation) while marking Automatable 'yes' and Technical Impact 'partial', matching the CVSS partial-impact metrics. There is no EPSS score, no CISA KEV listing, and no public POC provided, so there is no evidence of active exploitation - this is a real issue worth patching promptly on affected sites but not an emergency. Note the 'Authentication Bypass' tag slightly overstates the outcome: this is unverified-email account provisioning/takeover (CWE-287) rather than a wholesale auth control bypass.

An attacker who has harvested or guessed an existing guest customer's email address initiates a guest checkout on the store supplying that victim's email. Because the plugin never verifies control of the address, the checkout flow issues the attacker a logged-in account bound to the victim's email and exposes the victim's stored customer record (order history, address, PII). No public exploit code is identified at time of analysis, though SSVC rates the flaw automatable.