Address Disclosure Vulnerability in FluentCart eCommerce Plugin for WordPress
CVE-2026-100142
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 October 2026
Badges
What is CVE-2026-100142?
The FluentCart eCommerce plugin for WordPress, in versions prior to 2.2.0, is susceptible to an improper authentication vulnerability. This flaw allows unauthenticated attackers to select any stored customer address during the checkout process. Consequently, malicious actors can attach a victim's customer information—including postal addresses, phone numbers, and company details—to their own orders, leading to unauthorized access to sensitive customer data. This vulnerability highlights the critical need for proper user verification to safeguard personal information.
Affected Version(s)
FluentCart A New Era of eCommerce 0 < 2.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.