Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
FluentCart A New Era of eCommerce - Security Vulnerability (CVE-2026-120577)
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
FluentCart A New Era of eCommerce
CVE-2026-120577
Risk Score
Threat Entry
Updated 2026-09-30
FluentCart A New Era of eCommerce - Security Vulnerability (CVE-2026-100143)
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.
PLUGIN
FluentCart A New Era of eCommerce
CVE-2026-100143
Risk Score
Threat Entry
Updated 2026-08-26
FluentCart A New Era of eCommerce - Security Vulnerability (CVE-2026-14927)
The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store.
PLUGIN
FluentCart A New Era of eCommerce
CVE-2026-14927
Risk Score
Threat Entry
Updated 2026-07-28
FluentCart A New Era of eCommerce - Security Vulnerability (CVE-2026-14926)
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
PLUGIN
FluentCart A New Era of eCommerce
CVE-2026-14926
Risk Score