Fluentcart A New Era Of Ecommerce Faster Lighter And Simpler
Monthly
Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.
Authenticated SQL injection in the FluentCart WordPress eCommerce plugin, affecting all versions up to and including 1.7.0, lets users who hold shop-management privileges slip attacker-chosen keys into an unprepared bulk-product-update query and read arbitrary data out of the site's database. The vulnerable path is the product bulk-update flow, and on FluentCart Pro installs the non-administrator 'Manager' shop role carries the products/edit permission and can therefore trigger it without administrator access - which is why the effective privilege requirement is moderate rather than high. Reported by Wordfence, this is a genuine but constrained issue rather than an urgent fire-drill: no public exploit code and no confirmed active exploitation were identified at time of analysis, and impact is confined to confidentiality (database read/extraction) with no integrity or availability effect.
Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.
Authenticated SQL injection in the FluentCart WordPress eCommerce plugin, affecting all versions up to and including 1.7.0, lets users who hold shop-management privileges slip attacker-chosen keys into an unprepared bulk-product-update query and read arbitrary data out of the site's database. The vulnerable path is the product bulk-update flow, and on FluentCart Pro installs the non-administrator 'Manager' shop role carries the products/edit permission and can therefore trigger it without administrator access - which is why the effective privilege requirement is moderate rather than high. Reported by Wordfence, this is a genuine but constrained issue rather than an urgent fire-drill: no public exploit code and no confirmed active exploitation were identified at time of analysis, and impact is confined to confidentiality (database read/extraction) with no integrity or availability effect.