CVE-2026-100142
FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR
Unknown FluentCart A New Era of eCommerce
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.0FluentCart A New Era of eCommerceCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
Text from CVE List
Affected versions 1
- FluentCart A New Era of eCommerceaffected: all versions before 2.2.0CVE List