CVE-2026-14926

Name of the Vulnerable Software and Affected Versions FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.4.0

Description An Insecure Direct Object Reference (IDOR) exists in several payment-method endpoints. The plugin fails to verify if a subscription belongs to the requesting customer, allowing an authenticated user to modify another customer's subscription—including changing the payment method or cancelling and re-binding it—provided they know the target subscription identifier.

Recommendations Update the plugin to version 1.4.0 or later.