Executive brief
A vulnerability in the FluentCart eCommerce plugin for WordPress allows unauthorized individuals to access sensitive customer information. By simply changing a number in a web link, an attacker can view order details, including names, email addresses, and physical shipping addresses of other customers. This could lead to a significant data breach and loss of customer trust for online stores using this software.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the print route functionality of the FluentCart plugin. The plugin fails to validate if the requesting user has the authority to view a specific order before rendering documents such as invoices, packing slips, and delivery slips. Because these documents are identified by sequential numeric IDs, an unauthenticated attacker can automate requests to iterate through order numbers (e.g., order=1, order=2) to scrape Personally Identifiable Information (PII) including names, emails, and addresses. The issue is fixed in version 1.5.3.
Affected products
- Unknown FluentCart A New Era of eCommerce < 1.5.3
Timeline
- 2026-07-13: disclosed
- 2026-07-31: advisory: NVD publication date
- 1.5.3: patched