IDOR Vulnerability in FluentCart WordPress Plugin

The FluentCart WordPress plugin (version 1.7.0 and earlier) contains an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-103525. The flaw resides in an unauthenticated AJAX entry point designed for order and address retrieval. Because the plugin lacks server-side authorization checks, it relies entirely on client-provided order_id and address_id parameters. An attacker can enumerate these identifiers by exploiting the sequential nature of AUTO_INCREMENT database keys. By cycling through these numerical values, an unauthenticated user can exfiltrate sensitive customer PII, including street addresses, phone numbers, company names, VAT numbers, and legal registration IDs. Although a soft rate limit of five requests per 60 seconds exists, it is insufficient to prevent automated enumeration of the database over time. This vulnerability poses a significant risk to customer privacy and regulatory compliance.

Impact

Successful exploitation results in the unauthorized mass exfiltration of sensitive customer PII. Victims include any WordPress e-commerce site utilizing the vulnerable FluentCart plugin versions. Exposed data encompasses physical addresses, contact information, and business-related tax documentation, potentially leading to identity theft, fraud, or violations of data protection regulations.

Recommendation

• Update the FluentCart plugin to the latest available version beyond 1.7.0 immediately.
• Implement web application firewall (WAF) rules to detect and block high-frequency sequential requests to the specific AJAX endpoints associated with this plugin.
• Review web server access logs for anomalous, high-frequency POST or GET requests to the plugin's address/order retrieval AJAX URI patterns that result in HTTP 200 status codes but originate from distinct, unauthenticated sessions.
• Monitor for enumeration patterns in traffic, specifically looking for increments in numerical URL parameters or query strings associated with order retrieval.