CVE-2026-100143
Received Received - Intake

Unauthenticated Account Takeover in FluentCart WordPress Plugin

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WPScan

Description
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-100143
EUVD
EUVD-2026-89640

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fluentcart fluentcart to 1.6.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the FluentCart WordPress plugin before version 1.6.5. It allows unauthenticated attackers to take over guest customer accounts by exploiting the checkout email process. The plugin fails to verify if the person starting a guest checkout actually controls the provided email address. If an attacker knows the email of an existing guest customer, they can gain access to a logged-in account with that email and the customer's stored data.

Detection Guidance

Check if your FluentCart plugin version is below 1.6.5 by inspecting the WordPress admin panel under Plugins. Look for unauthenticated guest checkout attempts in server logs where the same email is used for multiple accounts.

Impact Analysis

If you use an affected version of FluentCart, an attacker could take over your guest account by knowing your email address. This could lead to unauthorized access to your account and the data associated with it, such as personal information or order history.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, which may violate compliance requirements under GDPR or HIPAA. Organizations using the affected plugin may face legal and regulatory penalties due to potential data breaches and loss of data integrity.

Mitigation Strategies

Immediately update the FluentCart plugin to version 1.6.5 or later through the WordPress admin panel. If updating is not possible, disable the plugin until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart