# FluentCart A New Era of eCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure via Smartcode Injection in Checkout Fields

- **ID:** WPSEC-2026-0844
- **Plugin:** FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (`fluent-cart`), https://wordpress.org/plugins/fluent-cart/
- **Affected versions:** all versions before 1.8.0
- **Fixed in:** 1.8.0 (Update to 1.8.0 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-1336
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-cart
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0844/

## Description

The FluentCart A New Era of eCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via smartcode injection in checkout fields in all versions up to, and including, 1.7.1, due to the plugin running the fully rendered thank-you and receipt page, including customer-supplied checkout text such as names and address fields, through its smartcode template parser, whose order, user and address parsers resolve arbitrary property paths across related records. This makes it possible for unauthenticated attackers to place smartcodes in the checkout fields of an order and have them resolved on that order's thank-you page, exposing data of the existing customer record the order is attached to, such as the linked WordPress account's login details and password hash and the details of that customer's other orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-0844/
- https://plugins.svn.wordpress.org/fluent-cart/tags/1.8.0/
- https://wordpress.org/plugins/fluent-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0844/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.