CVE-2026-100142

Deferred Deferred - Pending Action

Unauthenticated Address Attachment in FluentCart WordPress Plugin

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: WPScan

Description

The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-100142

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	FluentCart A New Era of eCommerce	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in the FluentCart WordPress plugin before version 2.2.0 allows unauthenticated attackers to attach any customer's stored address to an order they place without verification. This exposes customers' postal addresses, phone numbers, and company details.

Impact Analysis

If you are a customer using this plugin, your personal data like postal address, phone number, and company details could be exposed. If you are a site owner, this could lead to privacy violations and loss of customer trust.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized exposure of personal data. It may also conflict with HIPAA if customer addresses include protected health information, though HIPAA primarily applies to healthcare providers.

Mitigation Strategies

Update the FluentCart A New Era of eCommerce WordPress plugin to version 2.2.0 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-100142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70