The vulnerability is an insecure direct object reference that allows an attacker to retrieve customer billing and shipping address information. By controlling the order_id and billing_address_id parameters, an unauthenticated user can bypass the intended id-equality guard because the attacker supplies values for both sides of the comparison. This flaw permits enumeration of sequential AUTO_INCREMENT IDs and exfiltration of personally identifiable information, including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID. The weakness matches CWE‑639: authorization bypass through user controlled key.

The issue affects the WordPress plugin 'FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler' in all releases up to and including 1.7.0. No version information beyond 1.7.0 is given, implying newer releases may not contain the flaw.

The CVSS score of 7.5 indicates high severity, and the attack requires no authentication, relying only on crafted HTTP requests to the AJAX entry point. An attacker can enumerate order and address IDs rapidly because only a soft rate limit of five requests per minute is enforced. EPSS information is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, reducing its known prevalence in the wild, but the lack of authentication makes the risk serious for exposed sites.