Insecure Direct Object Reference Vulnerability in FluentCart Plugin for WordPress

CVE-2026-103525

What is CVE-2026-103525?

The FluentCart plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability that affects all versions up to and including 1.7.0. This flaw arises from a lack of proper validation on user-controlled parameters, specifically 'order_id' and 'billing_address_id' (and 'shipping_address_id'), allowing unauthenticated attackers to exploit it. By manipulating these parameters, attackers can sequentially enumerate AUTO_INCREMENT IDs to access and exfiltrate sensitive personal information (PII) of other customers, including billing and shipping addresses, phone numbers, VAT numbers, and legal registration IDs. The existing id-equality guard fails to effectively restrict address reuse, enabling unauthorized access due to the nature of the parameter control and the insufficient rate limiting in the unauthenticated AJAX entry point.

References