CVE-2026-103525: FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. No account, customer session, or user interaction is required.

Q: What information could be exposed?

An attacker can read stored billing and shipping address PII for other customers, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.

Q: What does exploitation require?

The attacker needs to enumerate sequential order and address ID pairs and supply matching attacker-controlled order_id with billing_address_id or shipping_address_id values. The affected endpoint does not verify authentication or ownership.

Q: Does rate limiting prevent exploitation?

No. The unauthenticated AJAX endpoint applies only a soft limit of five requests per 60 seconds, which does not replace an authentication or ownership check.

Q: Which installations are known to be affected?

All FluentCart versions up to and including 1.7.0 are affected according to the provided information.

Published Oct 16, 2026

Updated

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'orderid + billingaddressid (also shippingaddressid)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTOINCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.

Affected Software

1 affected component

FluentCart FluentCart<=1.7.0

Event History

Oct 16, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. No account, customer session, or user interaction is required.

What information could be exposed?

An attacker can read stored billing and shipping address PII for other customers, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID.

What does exploitation require?

The attacker needs to enumerate sequential order and address ID pairs and supply matching attacker-controlled order_id with billing_address_id or shipping_address_id values. The affected endpoint does not verify authentication or ownership.

Does rate limiting prevent exploitation?

No. The unauthenticated AJAX endpoint applies only a soft limit of five requests per 60 seconds, which does not replace an authentication or ownership check.

Which installations are known to be affected?

All FluentCart versions up to and including 1.7.0 are affected according to the provided information.

CVE-2026-103525: FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

What does exploitation require?

Does rate limiting prevent exploitation?

Which installations are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

What does exploitation require?

Does rate limiting prevent exploitation?

Which installations are known to be affected?