FluentCart CVE-2026-103525

No special configuration is required: exploitation targets the plugin's default unauthenticated AJAX checkout entry point in FluentCart versions up to and including 1.7.0, matching AV:N/AC:L/PR:N/UI:N. The specific prerequisite is that the attacker controls BOTH the order_id and the billing_address_id (or shipping_address_id) parameters, which defeats the id-equality guard intended to restrict address reuse. The only limiting factor is a soft rate limit of 5 requests per 60 seconds, which throttles but does not prevent bulk enumeration of sequential AUTO_INCREMENT IDs; there is no authentication or ownership check to satisfy. Impact is limited to reading stored billing/shipping PII - no write, modification, or availability impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 High) is internally consistent with the description: a remote, unauthenticated, low-complexity attack against confidentiality only, with no integrity or availability impact and no scope change. The signals align rather than conflict - this is a pure data-disclosure IDOR (CWE-639). No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis; absence of these signals is not evidence of safety, particularly for a Wordfence-reported bug where technical detail and the patch changeset are already public. The genuine aggravating factor is automatability: because records are keyed by sequential AUTO_INCREMENT order_id/address_id pairs and the only barrier is a soft 5-requests-per-60-seconds rate limit, mass enumeration of all stored customer PII is straightforward and scriptable. This is a real, actionable priority for any site running the affected versions, not a high-CVSS-but-low-real-risk issue - though its overall blast radius is bounded by the product's relatively small real-world deployment footprint rather than by any technical difficulty of exploitation.

A remote unauthenticated attacker scripts requests to the plugin's public AJAX checkout endpoint, submitting matched order_id and billing_address_id (or shipping_address_id) pairs and incrementing them sequentially. Because the attacker supplies both halves of the id-equality check, the ownership guard is satisfied trivially and each request returns another customer's stored billing/shipping PII (street address, city, state, postcode, phone, company, VAT number, legal registration ID). No public POC is referenced, but the Wordfence advisory and the public WordPress.org patch changeset make reconstruction straightforward.