CVE-2026-103518: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler

CVE-2026-103518 describes an SQL Injection vulnerability in the FluentCart WordPress plugin (versions up to and including 1.7.0). The flaw arises from improper neutralization of special elements in the 'products[*].variants[*].<attacker-chosen key>' parameter, allowing authenticated users with custom-level access or higher to inject additional SQL commands. This can lead to unauthorized extraction of sensitive data from the database. On FluentCart Pro, the Manager shop role, which has products/edit permission, can exploit this vulnerability without needing administrator-level access. The vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 4.9, indicating medium severity.

Authenticated users with custom-level access or higher can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. On FluentCart Pro, users with the Manager shop role can exploit this without administrator privileges, increasing the risk of data exposure. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with custom-level or higher privileges and review roles such as Manager shop role on FluentCart Pro to limit exposure. Monitor vendor channels for official patches or updates addressing this vulnerability.