CVE-2026-100142
FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
| Vendor | unknown |
| Product | fluentcart a new era of ecommerce |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown fluentcart a new era of ecommerce
Be the first to know when new unknown vulnerabilities affecting unknown fluentcart a new era of ecommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / FluentCart A New Era of eCommerce
0 < 2.2.0
References
Credits
Mutantgun WPScan