CVE-2026-14927 describes an authorization bypass vulnerability in the FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.5.3. The plugin does not verify user authorization or ownership before displaying customer order documents, which are accessible via sequential numeric keys. This allows unauthenticated attackers to enumerate order documents and obtain sensitive customer information such as personal names, email addresses, postal addresses, and order details. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

The vulnerability allows unauthorized disclosure of customer personal data including names, email addresses, billing and shipping addresses, and order details. There is no indication of integrity or availability impact. The CVSS score is 3.7 (low severity), reflecting limited impact and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a patch is available, restricting access to order documents or implementing additional authorization checks at the application or web server level may help mitigate exposure.