FluentCart EUVD-2026-108008

Exploitation requires a WordPress site running FluentCart (A New Era of eCommerce) at a version below 2.2.0 with its public checkout flow active and with target customers who have previously saved stored addresses. The attacker places an order through the normal checkout and supplies/references a stored-address identifier belonging to another customer; the plugin fails to validate ownership of that stored address (CWE-639), so no account credentials are needed (PR:N). Limiting factors: only customers who have stored addresses are exposed; the attacker likely must know or enumerate valid stored-address identifiers; disclosure is confined to postal address, phone number and company details (no payment data, credentials, or write/availability impact stated); and sites already on 2.2.0 or later are not affected.

This is a medium-severity information-disclosure flaw (CVSS 5.3), and the signals point to a genuine but bounded priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated path with no user interaction, which lowers the exploitation barrier; however, the impact is narrow - C:L with I:N and A:N - meaning only limited confidentiality loss (customer PII) and no integrity or availability impact. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation; a public PoC reference from WPScan exists but it is not verified as working exploit code. The vuln.today decision label is 'this_month', consistent with a real-but-non-critical IDOR (CWE-639) that should be remediated on a normal patch cadence rather than as an incident. Net: a legitimate privacy/data-exposure issue warranting the available patch within the month, not a high-CVSS-but-no-real-risk false alarm, but also not an act-now emergency given the limited scope and absence of KEV/EPSS escalation signals.

An unauthenticated attacker uses the public FluentCart checkout flow to place an order and, instead of supplying their own address, references the stored-address identifier of another customer; because the plugin never verifies that the selected stored address belongs to the requester, the attacker's order is populated with the victim's postal address, phone number and company details, which are then read back. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so weaponization effort is unconfirmed.