CVE-2026-100142mediumCWE-639

CVE-2026-100142: medium-severity vulnerability in FluentCart A New Era of eCommerce

FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR

Published

Follow this CVE+ Monitor FluentCart A New Era of eCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · FluentCart A New Era of eCommerce
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FluentCart A New Era of eCommerce

In the same product, most dangerous first.

CVE-2026-14927LOWFluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print RoutesEPSS 0.3%CVE-2026-14926MEDIUMFluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOREPSS 0.2%CVE-2026-100143MEDIUMFluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout EmailEPSS 0.2%