CVE-2026-14926 Overview
CVE-2026-14926 is a broken access control vulnerability in the FluentCart WordPress plugin before version 1.4.0. The plugin fails to verify that a subscription belongs to the requesting customer across several payment-method endpoints. Any authenticated customer who knows a target subscription identifier can act on another customer's subscription. Attackers can change the payment method or cancel and re-bind the subscription. The flaw maps to [CWE-284: Improper Access Control].
Critical Impact
Authenticated customers can manipulate other customers' subscriptions, including cancelling them or altering their payment method, when target subscription IDs are known.
Affected Products
- FluentCart WordPress plugin versions before 1.4.0
- WordPress sites running FluentCart eCommerce with authenticated customer accounts
- Merchants relying on FluentCart subscription/recurring billing features
Discovery Timeline
- 2026-07-28 - CVE-2026-14926 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-14926
Vulnerability Analysis
The vulnerability exists in FluentCart's payment-method endpoints handling subscription operations. The affected endpoints accept a subscription identifier and perform state changes without confirming the caller owns the referenced subscription. An authenticated customer session is the only prerequisite. Enumerating or guessing another customer's subscription ID grants the attacker equivalent authority over that subscription. This is a horizontal privilege escalation across customer accounts.
Root Cause
The root cause is a missing ownership check in the request handlers for subscription payment-method actions. The endpoints authenticate the user but do not authorize the user against the subscription record. This class of flaw is commonly described as Insecure Direct Object Reference (IDOR) and is categorized under [CWE-284].
Attack Vector
Exploitation requires network access to the WordPress site and a valid customer account. The attacker submits requests to the vulnerable payment-method endpoints while supplying a subscription identifier owned by a different customer. The server executes the requested action, including switching the payment method to one controlled by the attacker or cancelling and re-binding the subscription. Attack complexity is elevated because the attacker must obtain or guess a valid subscription identifier.
No verified public exploit code is available. See the WPScan Vulnerability Advisory for technical detail on the affected endpoints.
Detection Methods for CVE-2026-14926
Indicators of Compromise
- Unexpected subscription cancellations or payment-method changes recorded in FluentCart order and subscription logs.
- Requests to FluentCart payment-method endpoints where the authenticated user ID does not match the subscription owner.
- Customer complaints about missing subscriptions, unauthorized cancellations, or unfamiliar payment methods on their accounts.
Detection Strategies
- Review WordPress and FluentCart application logs for high volumes of subscription identifier access from a single authenticated session.
- Correlate customer session identifiers with the customer_id field on subscriptions targeted in payment-method API calls.
- Alert on sequential or brute-force patterns against subscription identifiers in HTTP request logs.
Monitoring Recommendations
- Enable verbose logging on all FluentCart REST and admin-AJAX endpoints handling subscriptions.
- Ship WordPress access logs to a centralized SIEM and retain them for post-incident review.
- Monitor payment processor webhooks for unexpected payment-method updates and cancellation events.
How to Mitigate CVE-2026-14926
Immediate Actions Required
- Update the FluentCart plugin to version 1.4.0 or later on all affected WordPress sites.
- Audit subscription activity logs for unauthorized payment-method changes or cancellations occurring before the patch was applied.
- Notify affected customers and reset payment methods on any subscriptions showing suspicious modifications.
Patch Information
Upgrade FluentCart to version 1.4.0 or later. This release adds the missing ownership verification on the affected payment-method endpoints. Refer to the WPScan Vulnerability Advisory for advisory details.
Workarounds
- If immediate patching is not possible, disable customer-facing subscription payment-method management until the update is applied.
- Restrict access to FluentCart subscription endpoints using a web application firewall rule that enforces ownership checks server-side or blocks anonymous enumeration of subscription IDs.
- Temporarily require manual merchant approval for payment-method changes on active subscriptions.
# Update FluentCart via WP-CLI to the fixed release
wp plugin update fluent-cart --version=1.4.0
wp plugin list --name=fluent-cart --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
