Medium severity · published Oct 22, 2026
CVE-2026-100142
FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FluentCart A New Era of eCommerce ·
before 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100142
wpscan.com
https://wpscan.com/vulnerability/ef4929d4-c048-413c-885b-0efafdf4e387/
More from FluentCart A New Era of eCommerce
6.5
CVE-2026-100143
FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email
4.2
CVE-2026-14926
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
3.7
CVE-2026-14927
FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes