What is the CVSS score of EUVD-2026-49703?

EUVD-2026-49703 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-49703?

Yes, a public proof-of-concept exploit is available for EUVD-2026-49703. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-49703?

Yes, a patch is available for EUVD-2026-49703. Update the affected software to the latest version immediately.

FluentCart EUVD-2026-49703

| CVE-2026-14926 MEDIUM

Improper Access Control (CWE-284)

2026-07-28 WPScan

GHSA-xch7-4rqw-9w56

WordPress Authentication Bypass Fluentcart A New Era Of Ecommerce Unknown

4.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Requires authenticated customer with subscription ID enumeration, so AC:H and PR:L; no confidentiality impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 14:43 vuln.today

CVSS changed

Jul 28, 2026 - 14:37 NVD

4.2 (MEDIUM)

Patch available

Jul 28, 2026 - 07:01 EUVD

CVE Published

Jul 28, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 28, 2026 - 06:00 cve.org

MEDIUM 4.2

DescriptionCVE.org

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.

AnalysisAI

Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.

Technical ContextAI

The vulnerability is an improper access control (CWE-284) in the FluentCart eCommerce WordPress plugin. The plugin exposes several payment-method endpoints that handle subscription actions such as changing the payment method or cancelling/re-binding a subscription. The flaw lies in the absence of server-side verification that the requesting authenticated customer actually owns the subscription specified by the identifier. An attacker who obtains a valid subscription ID (e.g., through enumeration or guessing) can impersonate the legitimate subscriber on those endpoints. The CPE cpe:2.3:a:unknown:fluentcart_a_new_era_of_ecommerce confirms the product identity; all versions prior to 1.4.0 are affected.

RemediationAI

Upgrade FluentCart to version 1.4.0 or later, which contains the fix for missing subscription ownership verification. The vendor has released the patched version; verify the update via the WordPress plugin repository or the vendor's official site. If immediate upgrade is not possible, as a compensating control, restrict access to subscription management endpoints by implementing additional IP whitelisting or requiring re-authentication via nonce verification for critical actions. Note that such workarounds may add friction for legitimate customers but reduce the attack surface.