CVE-2026-100142 FluentCart CVE debrief

Who should care

Defenders responsible for FluentCart A New Era of eCommerce plugin deployments, security teams, and administrators should assess exposure and implement compensating controls to prevent unauthorized access to customer addresses.

Why it matters

CVE-2026-100142 allows unauthenticated attackers to disclose customers' postal addresses, phone numbers, and company details by exploiting the FluentCart A New Era of eCommerce plugin before 2.2.0. Defenders should prioritize verifying inventory, assessing exposure, and implementing compensating controls.

• Verify inventory of FluentCart A New Era of eCommerce plugin versions to assess exposure
• Implement compensating controls to prevent unauthorized access to customer addresses
• Monitor for suspicious activity related to customer address disclosure

Technical summary

The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details. This vulnerability allows defenders to prioritize verifying inventory, assessing exposure, and implementing compensating controls to prevent unauthorized access to customer addresses.

Defensive priority

Defenders should prioritize verifying inventory of FluentCart A New Era of eCommerce plugin versions, assessing exposure, and implementing compensating controls to prevent unauthorized access to customer addresses.

Recommended defensive actions

• Verify inventory of FluentCart A New Era of eCommerce plugin versions
• Assess exposure to unauthenticated customer address disclosure
• Implement compensating controls to prevent unauthorized access to customer addresses
• Monitor for suspicious activity related to customer address disclosure
• Review vendor patch guidance
• Perform exposure review
• Track source information

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on affected versions, exploitation, or remediation. Defenders should verify inventory, assess exposure, and implement compensating controls. Evidence limits restrict further details. Official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.