{
 "id": "WPSEC-2026-0844",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0844/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0844/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0844/index.md",
 "title": "FluentCart A New Era of eCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Smartcode Injection in Checkout Fields",
 "description": "The FluentCart A New Era of eCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via smartcode injection in checkout fields in all versions up to, and including, 1.7.1, due to the plugin running the fully rendered thank-you and receipt page, including customer-supplied checkout text such as names and address fields, through its smartcode template parser, whose order, user and address parsers resolve arbitrary property paths across related records. This makes it possible for unauthenticated attackers to place smartcodes in the checkout fields of an order and have them resolved on that order's thank-you page, exposing data of the existing customer record the order is attached to, such as the linked WordPress account's login details and password hash and the details of that customer's other orders.",
 "plugin": {
  "slug": "fluent-cart",
  "name": "FluentCart A New Era of eCommerce",
  "full_name": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler",
  "wordpress_org": "https://wordpress.org/plugins/fluent-cart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-cart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-cart"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-1336"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.0",
 "remediation": "Update to 1.8.0 or later.",
 "fix_released": "2026-10-12T13:18:21+00:00",
 "published": "2026-10-13T13:59:35+00:00",
 "updated": "2026-10-13T12:12:59.588523+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0844/",
  "https://plugins.svn.wordpress.org/fluent-cart/tags/1.8.0/",
  "https://wordpress.org/plugins/fluent-cart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-cart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}