CVE-2026-103518

🗓️ 16 Oct 2026 03:38:40Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 34 Views🌐 WEB

Authenticated SQL Injection in FluentCart A New Era of eCommerce via 'products.variants' keys.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-103518	16 Oct 202603:51	–	circl
CNNVD	WordPress FluentCart: A New Era of eCommerce SQL Injection Vulnerabilities	15 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-103518 FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys	16 Oct 202603:38	–	cvelist
EUVD	EUVD-2026-102611	16 Oct 202603:38	–	euvd
NVD	CVE-2026-103518	16 Oct 202604:18	–	nvd
Patchstack	WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin <= 1.7.0 - Authenticated (Administrator+) SQL Injection vulnerability	15 Oct 202615:31	–	patchstack
Positive Technologies	PT-2026-115400	16 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-103518: Improper Neutralization of Special Elements used in an SQL Command	16 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-103518 FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys	16 Oct 202603:38	–	vulnrichment

Vulners

Node

wpmanageninja fluentcart_new_era_of_ecommerce_faster_lighter_and_simplerRange≤1.7.0wordpress

[
  {
    "vendor": "wpmanageninja",
    "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.7.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Services/BulkProductUpdateService.php
plugins	www.plugins.trac.wordpress.org/changeset/3734886/fluent-cart/trunk/app/Models/BatchQuery/Batch.php
plugins	www.plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/BatchQuery/Batch.php
plugins	www.plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Http/Controllers/ProductController.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505
plugins	www.plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Resource/ProductResource.php
wordpress	www.wordpress.org/plugins/fluent-cart/
plugins	www.plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Models/Concerns/CanUpdateBatch.php

Parameter	Position	Path	Description	CWE
products[].variants[].<attacker-chosen key>	request body	/products	SQL Injection via the 'products[].variants[].<attacker-chosen key>' parameter in the request body due to insufficient escaping and lack of query preparation.	CWE-89

16 Oct 2026 15:17Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.9

EPSS0.00377

SSVC

CWE-89

FluentCart A New Era of eCommerce WordPress SQL Injection products.variants database extraction Administrator+