WordPress Plugin Vulnerabilities

FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email

Description

The plugin does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.

Proof of Concept

Affects Plugins

Plugin icon
fluent-cart
Fixed in 1.6.5

References

CVE
CVE-2026-100143

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Mutantgun
Submitter
Mutantgun
Submitter website
https://mutantgun.com/
Verified
Yes
WPVDB ID
86c69e28-bdd2-4027-a045-f8b2523f8d7f

Timeline

Publicly Published
2026-09-28 (about 21 hours ago)
Added
2026-09-28 (about 7 hours ago)
Last Updated
2026-09-28 (about 7 hours ago)

Other

Published
Title
Published
2026-05-14
Title
Receive Notifications After Form Submitting – Form Notify for Any Forms < 1.1.11 - Unauthenticated Authentication Bypass via LINE OAuth Callback
Published
2021-08-24
Title
Booster for WooCommerce < 5.4.4 - Authentication Bypass
Published
2014-08-01
Title
WP Symposium <= 12.07.07 - Authentication Bypass
Published
2026-08-19
Title
Leyka <= 3.32.3 - Missing Authorization
Published
2024-08-12
Title
JobSearch <= 2.3.4 - Authentication Bypass to Account Takeover