{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fluentcart--1.6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fluentcart:fluentcart:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-120577"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FluentCart (\u003c= 1.6.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FluentCart"],"content_html":"\u003cp\u003eThe FluentCart plugin for WordPress (versions 1.6.2 and earlier) is susceptible to an arbitrary file deletion vulnerability. This flaw stems from improper file path validation within the plugin's \u003ccode\u003edeleteFile\u003c/code\u003e function. Authenticated users with custom-level access or higher can leverage this vulnerability to delete critical files on the web server, such as \u003ccode\u003ewp-config.php\u003c/code\u003e, which can result in application compromise or remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the deletion of arbitrary files on the hosting server. Deleting critical application configuration files, such as \u003ccode\u003ewp-config.php\u003c/code\u003e, may force the application into an installation state or facilitate further exploitation leading to remote code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the FluentCart plugin to the latest available version (beyond 1.6.2) to remediate the path validation flaw.\u003c/li\u003e\n\u003cli\u003eReview WordPress user role assignments to ensure that users with custom-level access and above are limited to trusted individuals.\u003c/li\u003e\n\u003cli\u003eAudit web server file access logs for requests targeting the \u003ccode\u003edeleteFile\u003c/code\u003e function logic, typically associated with administrative or plugin-specific API endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T05:55:04Z","date_published":"2026-11-03T05:55:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fluentcart-file-deletion/","summary":"The FluentCart WordPress plugin contains an arbitrary file deletion vulnerability in the deleteFile function that allows authenticated attackers to delete sensitive server files, potentially leading to remote code execution.","title":"FluentCart: Arbitrary file deletion (CVE-2026-120577)","url":"https://feed.craftedsignal.io/briefs/2026-11-fluentcart-file-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - FluentCart (\u003c= 1.6.2)","version":"https://jsonfeed.org/version/1.1"}