Read the docs
TI-2026-75160 Aliases CVE-2026-103525GHSA-96fh-fprm-v973

Insecure direct object reference in FluentCart exposes billing data

Priority LOW 39CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The FluentCart A New Era of eCommerce WordPress plugin is vulnerable in all versions up to and including 1.7.0. Missing validation of user-controlled order_id and billing_address_id parameters (CWE-639) lets unauthenticated remote attackers read other customers' billing and shipping addresses, including phone numbers and VAT numbers, by enumerating sequential IDs. The AJAX endpoint requires no authentication and applies only a soft rate limit of 5 requests per 60 seconds.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WP ManageNinja LLCFluentCart A New Era of eCommerce – Faster, Lighter, and Simplerup to 1.7.0—No fix listedCNA
  • FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler VendorWP ManageNinja LLC Affected up to 1.7.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for FluentCart A New Era of eCommerce (Faster, Lighter, and Simpler).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-103525
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Alias added: GHSA-96fh-fprm-v973

References

Other 6

  • TI-2021-13634 CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2022-04342 FluentAuth < 1.0.2 - Bypass blocks by IP Spoofing CVSS 3.1HIGH 7.5
  • TI-2024-11836 Ninja Tables < 5.0.17 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-00211 FluentSMTP < 2.2.3 - Stored XSS via Email Logs CVSS 3.1MEDIUM 5.4
  • TI-2026-51633 Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build CVSS 4.0CRITICAL 9.3
  • TI-2026-51632 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build CVSS 4.0CRITICAL 9.3
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences