FluentCart: Arbitrary file deletion (CVE-2026-120577)

The FluentCart plugin for WordPress (versions 1.6.2 and earlier) is susceptible to an arbitrary file deletion vulnerability. This flaw stems from improper file path validation within the plugin's deleteFile function. Authenticated users with custom-level access or higher can leverage this vulnerability to delete critical files on the web server, such as wp-config.php, which can result in application compromise or remote code execution.

Impact

Successful exploitation allows for the deletion of arbitrary files on the hosting server. Deleting critical application configuration files, such as wp-config.php, may force the application into an installation state or facilitate further exploitation leading to remote code execution.

Recommendation

• Update the FluentCart plugin to the latest available version (beyond 1.6.2) to remediate the path validation flaw.
• Review WordPress user role assignments to ensure that users with custom-level access and above are limited to trusted individuals.
• Audit web server file access logs for requests targeting the deleteFile function logic, typically associated with administrative or plugin-specific API endpoints.