Vulnerabilities / FluentCart A New Era of eCommerce / WPSEC-2026-0716
FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Integer Overflow to Order Total Manipulation via Cart Quantity
Medium 5.3
CWE-190Fixed in 1.7.1
- ID
- WPSEC-2026-0716
- Plugin
- FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (fluent-cart)
- Affected
- all versions before 1.7.1
- Remediation
- Update to 1.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-190
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-10
- Attack surface
- FluentCart A New Era of eCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The FluentCart A New Era of eCommerce plugin for WordPress is vulnerable to Integer Overflow in all versions up to, and including, 1.7.0 via the cart item quantity. This is due to the plugin not enforcing an upper bound on cart quantities, so a very large quantity causes the unit price multiplied by quantity to exceed the integer range, after which the wrapped value is cast and clamped. This makes it possible for unauthenticated attackers to create payable orders with a manipulated, e.g. zero, order total and obtain products without paying their price.
References
- https://wpsec.com/vuln/WPSEC-2026-0716/
- https://plugins.svn.wordpress.org/fluent-cart/tags/1.7.1/
- https://wordpress.org/plugins/fluent-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS