CVE-2026-14926

The CVE concerns FluentCart (WordPress plugin) versions before 1.4.0. The vulnerability arises in several payment-method endpoints that do not verify subscription ownership, allowing any authenticated customer to act on another customer’s subscription (e.g., changing its payment method, or cancel...