PT-2026-65395 · WordPress · Fluentcart
CVSS v3.1
4.2
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.4.0
Description
An Insecure Direct Object Reference (IDOR) exists in several payment-method endpoints. The plugin fails to verify if a subscription belongs to the requesting customer, allowing an authenticated user to modify another customer's subscription—including changing the payment method or cancelling and re-binding it—provided they know the target subscription identifier.
Recommendations
Update the plugin to version 1.4.0 or later.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fluentcart