FluentCart CVE-2026-109695

Exploitation requires the WPManageNinja FluentCart plugin to be installed and active on a WordPress site at version 1.7.1 or earlier (no fixed version is stated in the input, implying all versions through 1.7.1 are affected). Per the CVSS vector the data exposure is reachable over the network with no authentication (PR:N) and no user interaction (UI:N), but the description does not name the specific endpoint, parameter, or response that embeds the sensitive data, nor whether a particular FluentCart feature (e.g., checkout, order, or API responses) must be in use - this should be confirmed with the vendor. The primary limiting factor is deployment: only sites running this specific, relatively uncommon e-commerce plugin are exposed, and the impact is confined to disclosure of embedded sensitive data with no integrity or availability effect.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated issue with high confidentiality impact and no integrity or availability impact - consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data). However, every exploitation signal beyond the raw CVSS is either absent or low: there is no CISA KEV listing, no public exploit code referenced, and no EPSS score supplied in the input, so there is no evidence of active or imminent exploitation. There is also no SSVC decision data provided. The single reference is the Patchstack database advisory, which is the source of the score rather than an independent corroboration. Net assessment: this is a moderate, information-disclosure-only flaw whose high CVSS is driven entirely by the confidentiality-high/unauthenticated combination, not by demonstrated real-world exploitation; it should be patched but does not currently warrant emergency prioritization. Note a mild tension to verify with the vendor: the PR:N rating implies fully unauthenticated access to the sensitive data, but the description does not specify whether the embedded sensitive data is exposed in public responses or only in authenticated/privileged contexts - confirm the exposure path before treating it as trivially unauthenticated.

A remote attacker sends ordinary HTTP requests to a WordPress site running the FluentCart plugin (version 1.7.1 or earlier) and receives responses that embed sensitive data the plugin should not have included, allowing the attacker to harvest that information without authentication or user interaction. No public proof-of-concept or exploit code was identified in the provided data. Because the flaw is confidentiality-only, the attacker gains disclosed data but cannot directly modify or disrupt the store through this issue.