EUVD-2026-102641

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'orderid + billingaddressid also shippingaddressid' parameter due to missing validation on a user...

CVE-2026-103525

The FluentCart A New Era of eCommerce WordPress plugin (versions ≤ 1.7.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The issue stems from a lack of validation on the order_id and billing_address_id (or shipping_address_id) parameters within an unauthenticated AJAX entry point....