CVE-2026-103525 wpmanageninja CVE debrief

Who should care

Defenders responsible for WordPress installations with the FluentCart plugin should assess exposure and prioritize remediation due to the potential for unauthorized access to sensitive customer information.

Why it matters

The FluentCart plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing unauthenticated attackers to read and exfiltrate customer billing and shipping address PII. Defenders should prioritize verifying exposure and implementing compensating controls due to the potential for unauthorized access to sensitive customer information. The vulnerability is caused by missing validation on a user-controlled key, and the id-equality guard intended to restrict address reuse is bypassed. The unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check. Evidence is limited to the supplied CVE record and source references.

• Potential unauthorized access to sensitive customer billing and shipping address PII
• Possible enumeration of sequential order and address ID pairs
• Potential for attackers to bypass id-equality guard and soft rate limit
• Verification of exposure and implementation of compensating controls is necessary

Technical summary

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This vulnerability allows unauthenticated attackers to read and exfiltrate customer billing and shipping address PII by enumerating sequential order and address ID pairs. The vulnerability is caused by the id-equality guard intended to restrict address reuse being bypassed, as the attacker controls both halves of the compared pair. Additionally, the unauthenticated AJAX entry point imposes only a soft

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls due to the potential for unauthorized access to sensitive customer information.

Recommended defensive actions

• Verify exposure by checking if the FluentCart plugin version is 1.7.0 or earlier
• Implement compensating controls such as IP blocking or rate limiting to prevent unauthorized access
• Monitor for suspicious activity and implement logging and alerting for potential exploitation attempts
• Apply the vendor's remediation or patch when available
• Review and update incident response plans to include procedures for handling potential data breaches
• Conduct a thorough review of the FluentCart plugin's configuration and implementation to identify potential vulnerabilities
• Consider engaging with a third-party security expert to perform a vulnerability assessment and penetration testing

Evidence notes

The vulnerability is caused by missing validation on a user-controlled key in the 'order_id + billing_address_id (also shipping_address_id)' parameter. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.