The vulnerability in the FluentCart A New Era of eCommerce plugin allows an authenticated attacker to inject arbitrary SQL into queries through the use of unsanitized array keys in the 'products[*].variants[*].<key>' parameter. This flaw can be used to read arbitrary data from the database when the attacker has at least custom‑level access. On installations of the Pro version, users with the Manager shop role also possess the products/edit permission, allowing them to exploit the issue without administrator privileges.

This flaw affects the WordPress plugin created by wpmanageninja called FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler. All releases of the plugin through version 1.7.0 are vulnerable, including the 1.7.0 tag. No other product or version information is supplied.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access; the ability to craft requests to the vulnerable endpoint is needed, and the attacker must have custom‑level or higher permissions. Because the flaw permits extraction of sensitive data, the impact could lead to data disclosure; however, there is no evidence in the input of further consequences such as code execution or denial of service.