[ CVE-2026-100142 · Published 22 Oct 2026 ]
Vulnerability in Unknown FluentCart A New Era of eCommerce
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.