# FluentCart A New Era of eCommerce <= 1.7.0 - Unauthenticated Integer Overflow to Order Total Manipulation via Cart Quantity

- **ID:** WPSEC-2026-0716
- **Plugin:** FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (`fluent-cart`), https://wordpress.org/plugins/fluent-cart/
- **Affected versions:** all versions before 1.7.1
- **Fixed in:** 1.7.1 (Update to 1.7.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-190
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-cart
- **Fix released:** 2026-10-08
- **Published:** 2026-10-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0716/

## Description

The FluentCart A New Era of eCommerce plugin for WordPress is vulnerable to Integer Overflow in all versions up to, and including, 1.7.0 via the cart item quantity. This is due to the plugin not enforcing an upper bound on cart quantities, so a very large quantity causes the unit price multiplied by quantity to exceed the integer range, after which the wrapped value is cast and clamped. This makes it possible for unauthenticated attackers to create payable orders with a manipulated, e.g. zero, order total and obtain products without paying their price.

## References

- https://wpsec.com/vuln/WPSEC-2026-0716/
- https://plugins.svn.wordpress.org/fluent-cart/tags/1.7.1/
- https://wordpress.org/plugins/fluent-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0716/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.