The vulnerability is an IDOR flaw in the FluentCart WordPress plugin older than 2.2.0 that permits anyone to attach any stored customer address to a new order. This results in unauthorized disclosure of customers’ postal addresses, phone numbers, and company details.

The issue affects the FluentCart A New Era of eCommerce WordPress plugin, any installation using a version prior to 2.2.0.

The flaw can be exploited by unauthenticated attackers, so no authentication barrier is required. While an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the potential impact on confidentiality is significant. The lack of an authentication requirement and the straightforward request manipulation suggest that the vulnerability is moderately likely to be abused if a malicious actor is motivated.