CVE-2026-100142: FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running the FluentCart WordPress plugin before version 2.2.0 are affected. Customer records containing stored postal addresses, phone numbers, or company details may be exposed.
What does an attacker need to exploit it?
The attacker does not need to authenticate. They need to place an order and select another customer's stored address during checkout.
What information can be disclosed?
An attacker can read back the selected customer's stored postal address, phone number, and company details from the order they place.
How can I determine whether my site is affected?
Check the installed FluentCart version. Versions before 2.2.0 are affected.