The flaw in the FluentCart plugin is a SQL Injection weakness (CWE‑89) that permits an attacker with Administrator or higher privileges to inject arbitrary SQL commands by manipulating the 'groupKey' parameter. It originates from insufficient input sanitization and the lack of prepared statements in the query construction. By appending queries to the existing statement, an attacker may read or export sensitive data stored in the WordPress database, directly compromising customer and transaction confidentiality.

The issue impacts all WordPress installations running the FluentCart plugin version 1.3.1 or earlier. The plugin, distributed under the name FluentCart – A New Era of eCommerce – Faster, Lighter, and Simpler, is affected across its released sub‑versions up to the stated upper limit.

The CVSS score of 4.9 indicates a moderate severity, and the EPSS score is under 1%, suggesting exploitation is unlikely at present. The vulnerability is not catalogued in CISA KEV. An attacker must first gain Administrator-level access to the WordPress site; once authenticated, they can execute arbitrary SQL, potentially obtaining full database read capability. The lack of a widely available exploit reduces immediate risk but does not eliminate the threat.