EUVD-2026-51420
GHSA-4cx9-g5q6-23vf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Sequential numeric IDs require no special conditions to enumerate (AC:L, not AC:H); no authentication needed (PR:N); impact is limited to confidentiality of order PII (C:L, I:N, A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.
AnalysisAI
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Technical ContextAI
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic Insecure Direct Object Reference (IDOR) pattern. FluentCart - a WordPress eCommerce plugin - renders order documents at endpoints parameterized by sequential numeric order IDs. Because the plugin performs no authorization or ownership check before serving a document, any HTTP client that can reach the endpoint can retrieve any order's data by incrementing the ID. Sequential integers are trivially enumerable without brute force. The affected product is identified by CPE cpe:2.3:a:unknown:fluentcart_a_new_era_of_ecommerce:*:*:*:*:*:*:*:*, covering all releases prior to 1.5.3. As a WordPress plugin, exploitation is scoped to sites where the plugin is installed and the document endpoint is publicly reachable, which is the default behavior.
RemediationAI
Upgrade FluentCart to version 1.5.3 or later, which introduces authorization and ownership validation before rendering order documents; this is the vendor-released patch confirmed by the EUVD affected version range and WPScan advisory at https://wpscan.com/vulnerability/8e0d0e5d-b515-482f-aede-f7ed2046e4e3/. If an immediate upgrade is not possible, consider applying a WAF or server-layer rule to block unauthenticated requests to the order document URL pattern (e.g., deny access unless a valid session cookie is present); the trade-off is that this may break legitimate guest order lookup flows if those rely on the same unauthenticated endpoint. Alternatively, disabling the order document rendering feature entirely (if the plugin supports this toggle) eliminates the attack surface without affecting other store functionality. Any compensating control should be treated as temporary - the only durable fix is upgrading to 1.5.3.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today