Authorization Issues in FluentCart eCommerce Plugin for WordPress
CVE-2026-14927
Currently unrated
What is CVE-2026-14927?
The FluentCart WordPress plugin prior to version 1.5.3 is susceptible to an authorization bypass vulnerability. Due to the lack of authorization or ownership checks, unauthorized users can access and disclose sensitive customer information, such as names, email addresses, shipping and billing addresses, and specific order details. This serious flaw enables potential data enumeration, posing risks to customer privacy and security across online stores utilizing this plugin.
Affected Version(s)
FluentCart A New Era of eCommerce 0 < 1.5.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.