CVE-2026-14926 is an improper access control vulnerability (CWE-284) in the FluentCart A New Era of eCommerce WordPress plugin prior to version 1.4.0. The plugin fails to verify ownership of a subscription in several payment-method related endpoints, enabling authenticated users to act on subscriptions belonging to other customers when they know the subscription ID. This can lead to unauthorized changes to payment methods or cancellation and re-binding of subscriptions. The CVSS 3.1 base score is 4.2 (medium), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker with an authenticated customer account can modify or cancel other customers' subscriptions if they know the subscription identifier. This can disrupt subscription payments and service continuity for affected users. There is no direct confidentiality impact reported. The integrity and availability impacts are low but non-negligible as subscription data can be altered or invalidated.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to subscription identifiers and monitor for suspicious subscription modifications. Avoid sharing subscription identifiers publicly or with untrusted parties.