CVE-2026-103525: CWE-639 Authorization Bypass Through User-Controlled Key in wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler

CVE-2026-103525 is an authorization bypass vulnerability (CWE-639) in the FluentCart WordPress plugin (up to version 1.7.0). The flaw involves insecure direct object references via the 'order_id' and 'billing_address_id' (also 'shipping_address_id') parameters, which lack proper validation. Attackers can manipulate these parameters to bypass the intended id-equality check that restricts address reuse, enabling them to sequentially enumerate AUTO_INCREMENT order and address IDs. This leads to unauthorized disclosure of sensitive billing and shipping PII such as street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID. The vulnerability is exploitable without authentication due to a soft rate limit of only 5 requests per 60 seconds on an AJAX endpoint.

An unauthenticated attacker can read and exfiltrate personally identifiable information (PII) of other customers, including billing and shipping addresses and related sensitive data. This compromises customer privacy and may lead to further privacy violations or fraud. The vulnerability does not impact data integrity or availability but results in high confidentiality impact.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX endpoint and implement stronger validation and authentication checks on order and address ID parameters to prevent unauthorized enumeration and data access.