CVE-2026-14927: FluentCart WordPress Information Disclosure

CVE-2026-14927 Overview

CVE-2026-14927 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the FluentCart - A New Era of eCommerce WordPress plugin before version 1.5.3. The plugin renders customer order documents keyed on a sequential numeric identifier without performing authorization or ownership checks. Unauthenticated visitors can enumerate order IDs and disclose customer personal data across the store. Exposed data includes customer names, email addresses, billing and shipping postal addresses, and order details.

Critical Impact
Unauthenticated attackers can enumerate sequential order identifiers to harvest customer personally identifiable information (PII) from any FluentCart-powered WordPress store running a vulnerable version.

Affected Products

FluentCart - A New Era of eCommerce WordPress plugin versions before 1.5.3

Discovery Timeline

2026-07-31 - CVE-2026-14927 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14927

Vulnerability Analysis

The FluentCart plugin exposes customer order documents through an endpoint that accepts a numeric identifier. The endpoint retrieves and renders the corresponding order record without validating that the requester owns the order or holds a valid session. Because the identifier is a sequential integer, an attacker can iterate through the numeric range and pull each order in turn.

The disclosed data set includes customer names, email addresses, billing and shipping postal addresses, and order line items. This aggregation of order data enables targeted phishing, credential stuffing preparation, and physical-address-based fraud against store customers. The flaw falls under CWE-639: Authorization Bypass Through User-Controlled Key.

Root Cause

The root cause is the absence of an authorization or ownership check in the order document rendering path. The plugin trusts the numeric identifier supplied by the client and returns the associated record. Sequential, guessable identifiers compound the issue by making enumeration trivial.

Attack Vector

An attacker sends unauthenticated HTTP requests to the vulnerable order document endpoint, incrementing the numeric identifier on each request. No authentication, session, or user interaction is required. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14927

Indicators of Compromise

Sequential HTTP GET requests from a single source targeting FluentCart order document URLs with incrementing numeric identifiers.
Unusual volume of 200 OK responses from FluentCart order endpoints originating from unauthenticated sessions.
Access log entries containing FluentCart order document paths from clients without prior authentication cookies.

Detection Strategies

Inspect web server access logs for repeated requests to FluentCart order rendering endpoints with monotonically increasing IDs.
Correlate requester IP addresses across short time windows to identify enumeration patterns against order identifiers.
Alert on unauthenticated requests to order-related URIs that return sensitive customer fields in the response body.

Monitoring Recommendations

Enable WordPress access logging with full URI capture and forward logs to a centralized analytics platform for query-based hunting.
Configure web application firewall rules to rate-limit and flag sequential ID enumeration against FluentCart endpoints.
Review outbound data volumes from the WordPress host for spikes that may indicate mass PII scraping.

How to Mitigate CVE-2026-14927

Immediate Actions Required

Update the FluentCart plugin to version 1.5.3 or later on all WordPress sites where it is installed.
Audit web server and WordPress access logs for prior enumeration activity against order document endpoints.
Notify affected customers if evidence of unauthorized order data access is discovered during log review.

Patch Information

Upgrade the FluentCart - A New Era of eCommerce plugin to version 1.5.3 or later. This release adds the authorization and ownership check that was missing from the order document rendering path. See the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to FluentCart order document endpoints at the web application firewall until the plugin is updated.
Deploy WAF rules that require an authenticated WordPress session cookie for requests to order-rendering paths.
Temporarily disable the FluentCart plugin on stores that cannot immediately apply the 1.5.3 update.

bash

# Example WAF rule concept: block unauthenticated access to FluentCart order documents
# Adapt to your WAF syntax (ModSecurity, Cloudflare, AWS WAF, etc.)
SecRule REQUEST_URI "@rx /fluent-cart/.*/order/[0-9]+" \
    "id:1029142701,phase:1,deny,status:403,\
     chain,msg:'Block unauthenticated FluentCart order enumeration (CVE-2026-14927)'"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"