WordPress FluentCart A New Era of eCommerce plugin < 1.6.5 - Unauthenticated Guest Customer Account Takeover vulnerability

Unauthenticated Guest Customer Account Takeover vulnerability discovered by Mutantgun in WordPress Plugin FluentCart versions 1.6.5...

CVE-2026-100143

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

EUVD-2026-89640

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

CVE-2026-100143 FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

CVE-2026-100143

The FluentCart A New Era of eCommerce WordPress plugin, in versions prior to 1.6.5 , is vulnerable to an unauthenticated guest customer account takeover . The root cause is a failure to verify that the individual placing a guest checkout actually controls the provided email address. An unauthenti...

CVE-2026-100143 FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

WordPress FluentCart A New Era of eCommerce plugin < 1.5.3 - Unauthenticated Order PII Disclosure vulnerability

Unauthenticated Order PII Disclosure vulnerability discovered by Diogo Pinto in WordPress Plugin FluentCart versions 1.5.3...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927 FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927 FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.5.3 contains an authorization bypass vulnerability. The plugin fails to perform proper authorization or ownership checks when rendering customer order documents that are indexed using sequential numeric identifiers . This ...

EUVD-2026-51420

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927: Authorization Bypass Through User-Controlled Key

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14926

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...

CVE-2026-14926 FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...

CVE-2026-14926

The FluentCart A New Era of eCommerce WordPress plugin, in versions before 1.4.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that a subscription belongs to the requesting customer across several payment-method endpoints . This oversight allows an...

EUVD-2026-49703

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...

WordPress FluentCart A New Era of eCommerce plugin < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering vulnerability

Subscriber+ Subscription Payment-Method Tampering vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin FluentCart versions 1.4.0...

CVE-2026-14926 FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...