WordPress Plugin Vulnerabilities

FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR

Description

The plugin does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

Proof of Concept

Affects Plugins

Plugin icon
fluent-cart
Fixed in 2.2.0

References

CVE
CVE-2026-100142

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Mutantgun
Submitter
Mutantgun
Submitter website
https://mutantgun.com/
Verified
Yes
WPVDB ID
ef4929d4-c048-413c-885b-0efafdf4e387

Timeline

Publicly Published
2026-10-20 (about 2 days ago)
Added
2026-10-20 (about 1 day ago)
Last Updated
2026-10-20 (about 1 day ago)

Other

Published
Title
Published
2026-09-21
Title
Custom Field Template < 2.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter
Published
2025-10-10
Title
WPC Smart Wishlist for WooCommerce < 5.0.4 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Published
2026-09-10
Title
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
Published
2026-08-26
Title
Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR
Published
2024-06-20
Title
User Profile Picture < 2.6.2 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update