{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fluentcart-a-new-era-of-ecommerce--faster-lighter-and-simpler--1.7.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fluentcart:fluentcart:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-103525"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (\u003c= 1.7.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FluentCart"],"content_html":"\u003cp\u003eThe FluentCart WordPress plugin (version 1.7.0 and earlier) contains an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-103525. The flaw resides in an unauthenticated AJAX entry point designed for order and address retrieval. Because the plugin lacks server-side authorization checks, it relies entirely on client-provided order_id and address_id parameters. An attacker can enumerate these identifiers by exploiting the sequential nature of AUTO_INCREMENT database keys. By cycling through these numerical values, an unauthenticated user can exfiltrate sensitive customer PII, including street addresses, phone numbers, company names, VAT numbers, and legal registration IDs. Although a soft rate limit of five requests per 60 seconds exists, it is insufficient to prevent automated enumeration of the database over time. This vulnerability poses a significant risk to customer privacy and regulatory compliance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized mass exfiltration of sensitive customer PII. Victims include any WordPress e-commerce site utilizing the vulnerable FluentCart plugin versions. Exposed data encompasses physical addresses, contact information, and business-related tax documentation, potentially leading to identity theft, fraud, or violations of data protection regulations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the FluentCart plugin to the latest available version beyond 1.7.0 immediately.\u003c/li\u003e\n\u003cli\u003eImplement web application firewall (WAF) rules to detect and block high-frequency sequential requests to the specific AJAX endpoints associated with this plugin.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous, high-frequency POST or GET requests to the plugin's address/order retrieval AJAX URI patterns that result in HTTP 200 status codes but originate from distinct, unauthenticated sessions.\u003c/li\u003e\n\u003cli\u003eMonitor for enumeration patterns in traffic, specifically looking for increments in numerical URL parameters or query strings associated with order retrieval.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:25:05Z","date_published":"2026-10-16T06:25:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fluentcart-idor/","summary":"The FluentCart plugin for WordPress up to version 1.7.0 contains an IDOR vulnerability allowing unauthenticated attackers to exfiltrate customer billing and shipping PII via sequential ID enumeration.","title":"IDOR Vulnerability in FluentCart WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-fluentcart-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - FluentCart a New Era of ECommerce – Faster, Lighter, and Simpler (\u003c= 1.7.0)","version":"https://jsonfeed.org/version/1.1"}