CVE-2026-14927
Received Received - Intake

Unauthenticated Order Data Exposure in FluentCart WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14927
EUVD
EUVD-2026-51420

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fluentcart fluentcart to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the FluentCart WordPress plugin before version 1.5.3. It allows unauthenticated users to access customer order documents by guessing sequential numeric IDs. These documents contain sensitive personal data like names, email addresses, postal addresses, and order details.

Detection Guidance

Check if the FluentCart plugin version is below 1.5.3. Look for exposed order documents by accessing URLs with sequential numeric IDs like /order-details/?order_id=1,2,3 etc. Use tools like curl or wget to fetch these pages and inspect for customer data leaks.

Impact Analysis

Unauthenticated attackers can enumerate and access customer data, leading to privacy breaches. This exposes personal information, enabling identity theft, phishing attacks, or misuse of customer details. Stores using the vulnerable plugin risk reputational damage and legal consequences.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to implement adequate security measures. It may also breach HIPAA if customer data includes protected health information, as unauthorized disclosure is prohibited under the regulation.

Mitigation Strategies

Update the FluentCart plugin to version 1.5.3 or later immediately. If updating is not possible, disable the plugin temporarily until a patch is applied. Review server logs for unauthorized access attempts to order documents.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart