Threats tagged 'ghsa-4cx9-g5q6-23vf'

A vulnerability in the FluentCart A New Era of eCommerce WordPress plugin before version 1.5.3 allows unauthenticated visitors to access customer order documents without authorization checks. This flaw enables enumeration and disclosure of customer personal data including names, email addresses, billing and shipping addresses, and order details. The vulnerability is due to missing authorization or ownership verification when rendering order documents keyed by a sequential numeric identifier.