{
 "id": "WPSEC-2026-0716",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0716/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0716/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0716/index.md",
 "title": "FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Integer Overflow to Order Total Manipulation via Cart Quantity",
 "description": "The FluentCart A New Era of eCommerce plugin for WordPress is vulnerable to Integer Overflow in all versions up to, and including, 1.7.0 via the cart item quantity. This is due to the plugin not enforcing an upper bound on cart quantities, so a very large quantity causes the unit price multiplied by quantity to exceed the integer range, after which the wrapped value is cast and clamped. This makes it possible for unauthenticated attackers to create payable orders with a manipulated, e.g. zero, order total and obtain products without paying their price.",
 "plugin": {
  "slug": "fluent-cart",
  "name": "FluentCart A New Era of eCommerce",
  "full_name": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
  "wordpress_org": "https://wordpress.org/plugins/fluent-cart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-cart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-cart"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-190"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.1",
 "remediation": "Update to 1.7.1 or later.",
 "fix_released": "2026-10-08T14:52:13+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:53:31.146061+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0716/",
  "https://plugins.svn.wordpress.org/fluent-cart/tags/1.7.1/",
  "https://wordpress.org/plugins/fluent-cart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-cart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-10"
 }
}