EUVD-2026-115671
GHSA-m2cg-gh5f-5vp8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as custom-level FluentCart user
-
DeliveryCall deleteFile endpoint with traversal path
-
ExploitDelete wp-config.php via unvalidated path
-
ExecutionForce WordPress into setup/install mode
-
ImpactHijack installation for site takeover (RCE)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress session with a FluentCart 'custom-level access and above' role (PR:L) - not available to anonymous visitors, which is the primary limiting factor. The flaw lies in the deleteFile function's insufficient path validation (LocalDriver.php) reachable through the file-upload controller and REST route (FileUploadController.php / api.php), affecting all FluentCart versions up to and including 1.6.2. No special non-default configuration or user interaction is required beyond holding a qualifying account; the leap to remote code execution is conditional on deleting a high-value file such as wp-config.php, which the advisory cites as the realistic escalation path. |
| Impact | This is a genuine, prioritizable issue but short of an emergency. The CVSS 3.1 score of 8.1 (High) is driven by a network-reachable vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N) - consistent with arbitrary file deletion rather than data theft. The vuln.today decision label is 'this_week', which signals near-term remediation urgency without the act_now/emergency escalation. Critically, PR:L confirms this is NOT unauthenticated: an attacker needs an authenticated FluentCart account at 'custom-level access and above', which materially reduces the opportunistic attack surface compared to a PR:N flaw. No EPSS score was supplied, so statistical exploitation probability cannot be stated. The vulnerability is NOT in CISA KEV and no confirmed public exploit code was provided - only a Wordfence advisory and WordPress.org source/changeset links. The main amplifier is the documented path from file deletion to RCE: deleting wp-config.php can force WordPress into its setup/installation state, enabling full takeover. Net: a real priority to patch this week, but the authentication requirement makes it targeted/insider-leaning rather than mass-exploitable at internet scale. |
| Exploit ScenarioDerived | An attacker who holds or obtains a low-privilege FluentCart account ('custom-level access and above') sends a crafted request to the file-deletion endpoint with a manipulated path that escapes the intended directory. By deleting wp-config.php, they push WordPress back into its installation routine and can reconnect it to an attacker-controlled database, leading to full site compromise. No confirmed public exploit code was provided, though a Wordfence advisory and the vulnerable source are publicly referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Authenticated users holding a FluentCart custom-level role or higher can delete arbitrary files on a WordPress server running the FluentCart eCommerce plugin through version 1.6.2, because the plugin's deleteFile routine in LocalDriver.php does not properly validate the supplied file path. The flaw is reachable over the network through the plugin's file-upload controller and its REST route, requires no user interaction, and carries high integrity and availability impact; deleting a critical file such as wp-config.php can force a WordPress reinstall flow or knock the site offline, which the advisory cites as the realistic path toward code execution. The primary limiting factor is that the attacker must already hold a qualifying FluentCart account, so anonymous visitors cannot exploit it. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and it is assessed as a genuine, prioritizable problem that should be handled in this week's maintenance cycle rather than an emergency.
RemediationAI
No tagged patched release is identified in the supplied data: the vendor-side fix appears as plugin repository changeset 3661075 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3661075%40fluent-cart&new=3661075%40fluent-cart), so treat this as an upstream fix available via commit/changeset with the released patched version not independently confirmed - check the plugin's WordPress.org page and the Wordfence advisory before upgrading, and move to the first version published after 1.6.2 rather than staying on the vulnerable tag. Because exploitation requires only a low-privileged FluentCart account at custom-level access or above, review and prune those roles and any store accounts that do not need file-management capability; this reduces exposure but does not remove the vulnerable code path for legitimate staff. If an updated build cannot be deployed immediately, deactivating or removing the FluentCart plugin eliminates the attack surface entirely at the cost of losing store functionality, and restricting access to the plugin's REST routes (for example the route defined in app/Http/Routes/api.php) through a WAF or server-level rule limits remote reachability but is bypassable if the rule is imprecise. Confirm the fix by verifying the installed plugin version and, if needed, inspecting the deleteFile implementation in LocalDriver.php for path validation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FluentCart is a PHP-based WordPress eCommerce plugin published by WPManageNinja. The vulnerability is a CWE-22 path traversal class defect: the plugin accepts a file path through its HTTP layer (the FileUploadController at app/Http/Controllers/FileUploadController.php and the REST route registered in app/Http/Routes/api.php) and passes it into the file-system abstraction's deleteFile method in app/Services/FileSystem/Drivers/Local/LocalDriver.php, where traversal sequences or absolute paths are insufficiently normalized before the underlying delete operation runs. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H confirms remote reachability, low attack complexity, and a low-privileged authenticated requirement, with impact limited to integrity and availability of the host rather than direct confidentiality loss. The escalation to remote code execution is conditional and indirect: it depends on the attacker deleting a high-value file, with wp-config.php named in the advisory as the representative case, so a successful deletion is best treated as destructive file-system manipulation whose RCE potential is situational rather than guaranteed. The exact request parameters and sanitization gap are not detailed in the available sources beyond the referenced code locations.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable REST endpoint (AV:N/AC:L) requiring a low-privileged custom-level account (PR:L, not PR:N); arbitrary deletion yields high integrity and availability impact but no direct confidentiality loss (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
DescriptionNVD
The FluentCart A New Era of eCommerce - Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Articles & Coverage 1
Executive ViewAI
CVE-2026-120577 is a high-severity vulnerability in the FluentCart eCommerce plugin (versions up to 1.6.2) for WordPress that allows authenticated users with custom-level roles or higher to delete arbitrary files, potentially causing site downtime or forcing a reinstall. This impacts organizations running FluentCart, particularly eCommerce businesses where site availability is critical for revenue and reputation. Leadership should prioritize this because a malicious insider or compromised low-privilege account could disrupt operations and lead to data loss.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the plugin's file-upload controller and REST endpoints, enforce least privilege by limiting accounts with custom-level or higher FluentCart roles, deploy a WAF to detect and block path traversal attempts, and maintain offline backups to enable rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB