CVE-2026-103525
Received Received - Intake

Insecure Direct Object Reference in FluentCart WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-103525
EUVD
EUVD-2026-102641

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the FluentCart WordPress plugin versions up to 1.7.0. It allows unauthenticated attackers to access other customers' stored billing and shipping address PII by manipulating order and address ID parameters. The plugin fails to validate user-controlled keys properly, enabling attackers to enumerate sequential IDs and bypass access controls.

Detection Guidance

This vulnerability can be detected by checking for unauthorized access to billing or shipping address data via sequential order and address ID enumeration. Monitor server logs for repeated AJAX requests to the vulnerable endpoint with varying order_id and billing_address_id parameters. Use tools like curl to test for exposure by sending requests to the affected endpoint with sequential IDs.

Impact Analysis

This vulnerability can expose your personal data, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID. Attackers can access this information without authentication by exploiting sequential ID enumeration, potentially leading to identity theft or targeted phishing attacks.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient protection measures. It may also conflict with HIPAA if protected health information is exposed. Organizations using this plugin could face regulatory fines and legal consequences for failing to secure customer data.

Mitigation Strategies

Immediately update the FluentCart plugin to the latest version beyond 1.7.0. Disable unauthenticated AJAX endpoints if possible or implement strict rate limiting and ownership validation. Review server logs for signs of exploitation and restrict access to PII data. Consider temporarily disabling the plugin until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart