FluentCart A New Era of eCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Smartcode Injection in Checkout Fields
- ID
- WPSEC-2026-0844
- Plugin
- FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (fluent-cart)
- Affected
- all versions before 1.8.0
- Remediation
- Update to 1.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-1336
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- FluentCart A New Era of eCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The FluentCart A New Era of eCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via smartcode injection in checkout fields in all versions up to, and including, 1.7.1, due to the plugin running the fully rendered thank-you and receipt page, including customer-supplied checkout text such as names and address fields, through its smartcode template parser, whose order, user and address parsers resolve arbitrary property paths across related records. This makes it possible for unauthenticated attackers to place smartcodes in the checkout fields of an order and have them resolved on that order's thank-you page, exposing data of the existing customer record the order is attached to, such as the linked WordPress account's login details and password hash and the details of that customer's other orders.
References
- https://wpsec.com/vuln/WPSEC-2026-0844/
- https://plugins.svn.wordpress.org/fluent-cart/tags/1.8.0/
- https://wordpress.org/plugins/fluent-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS