FluentCart CVE-2026-103518

Requires an authenticated FluentCart account with 'custom-level access and above'; on FluentCart Pro this explicitly includes the non-administrator 'Manager' shop role, which holds the products/edit permission. Exploitation occurs through the product bulk-update code path (ProductController/BulkProductUpdateService/Batch query) by supplying an attacker-chosen key within the 'products[*].variants[*]' structure that is concatenated into an unprepared SQL query. Limiting factors: the attacker must already possess a privileged shop-management account (no anonymous or subscriber-level access), impact is confined to database read/extraction (no write or availability impact), and only versions up to and including 1.7.0 are affected - upgrading past the patched release eliminates the vector.

This is a genuine but constrained vulnerability rather than an urgent fire-drill. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) correctly captures the core trade-off: the flaw is network-reachable with low attack complexity and no user interaction, but it requires an authenticated privileged account, which caps the base score in the Medium range. The impact is confidentiality-only (C:H, I:N, A:N) - a SQL injection used to read sensitive database contents, not to modify data or crash the service. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; SSVC-style signals (automatable, exploitation status) are effectively absent. One important nuance in the description partially conflicts with the PR:H rating: WordFence rates privileges as High, but the text states that on FluentCart Pro the non-administrator 'Manager' shop role already holds the products/edit permission and can exploit this WITHOUT administrator access - which argues the real-world privilege barrier is closer to PR:L than PR:H and the effective risk is somewhat higher than 4.9 suggests on Pro installations. Verify the required role level against the vendor advisory. Overall: a real priority for sites running FluentCart (especially Pro with multiple shop-manager staff), but not a mass-exploitation emergency given the authentication requirement and confidentiality-only impact.

An attacker who holds (or phishes/compromises) a FluentCart shop account with custom-level access - or a non-admin 'Manager' role on FluentCart Pro - sends a crafted product bulk-update request where an attacker-chosen key under products[*].variants[*] carries injected SQL. Because the parameter is insufficiently escaped and the query is not properly prepared, the appended SQL executes and returns sensitive database contents such as user records or credentials. No public exploit code was identified in the provided data, but low attack complexity (AC:L) makes manual exploitation straightforward for an authenticated user.