Technical impact
The flaw in FluentCart, a WordPress eCommerce plugin, does not verify ownership of the email address used during a guest checkout. An unauthenticated attacker who knows a valid guest customer's email can submit a checkout request, causing the system to create a logged‑in session associated with that email and grant the attacker full access to the customer’s stored data. This privilege escalation results in loss of confidentiality for personal and purchase information and allows account impersonation and potential fraudulent activity.
Affected Systems
FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.6.5 are affected. Any site that has installed the plugin without upgrading to the patched release is at risk, especially those that allow guest checkout without email confirmation.
Risk and Exploitability
Based on the description, the likely attack vector is through unauthenticated HTTP requests to the guest checkout endpoint, requiring only knowledge of a valid email address. No cryptographic weakness or sensitive data exposure is specified; the risk lies in the unauthorized account takeover. The EPSS score of < 1% indicates a low exploitation probability, and the vulnerability is not listed in CISA KEV, but its moderate CVSS score of 6.5 and the impact on user data still warrant attention, especially in environments that allow guest checkouts.
