Fluentcart A New Era Of Ecommerce
Monthly
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Authenticated customers of the FluentCart WordPress plugin can manipulate other users' subscriptions by exploiting missing ownership verification in payment-method endpoints. The vulnerability affects versions before 1.4.0 and allows an attacker with low privileges to change payment methods or cancel subscriptions if they know the target subscription identifier. Publicly available exploit code exists, but EPSS probability is low (0.13%) and no active exploitation in CISA KEV has been reported.