Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103525— FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

Quick assessment

Affected
wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"FluentCart：电商新时代——更快、更轻、更简”在所有 1.7.0 及更早版本中存在不安全的直接对象引用（IDOR）漏洞。该漏洞源于对由用户控制的键（即 与 （或 ））缺少验证。这使得未认证的攻击者能够通过枚举顺序递增的 AUTO_INCREMENT 订单 ID 与地址 ID 对，读取并窃取其他客户存储的账单和收货地址个人敏感信息（PII），包括街道地址、城市、州、邮政编码、电话号码、公司名称、增值税号以及法定注册 ID。 原本用于限制地址复用的 ID 相等性防护机制已被绕过，因为攻

CVSS 7.5 · High EPSS 0.38% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler ≤ 1.7.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103525

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
Source: CVE Program / CVE List V5
Vulnerability Description
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler 0 ~ 1.7.0 -

II. Public POCs for CVE-2026-103525

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103525

请登录查看更多情报信息。

Vendor Pages for CVE-2026-103525 (1)

IV. Related Vulnerabilities

Same product: FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
Same vendor: wpmanageninja
Same weakness: CWE-639

V. Comments for CVE-2026-103525

No comments yet

Leave a comment