The vulnerability in FluentCart versions prior to 1.5.3 arises from a lack of authorization checks when rendering customer order documents. An unauthenticated visitor can request order print routes keyed by a sequential numeric identifier, causing the plugin to reveal names, email addresses, billing and shipping postal addresses, and detailed order information. This results in a confidentiality breach of sensitive personal data for all customers represented in the store.

All installations of the FluentCart WordPress plugin with a version less than 1.5.3 are affected. The issue originates in the plugin’s order print routes that accept a numeric order ID without verifying the requester’s identity or ownership of the order.

The CVSS score is not provided, but the lack of authentication required for exploitation and the breadth of disclosed personal information strongly suggest a high severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The exploitation path is simple: any web visitor can construct URLs to sequential order identifiers and retrieve sensitive order documents without needing credentials. No additional conditions or configuration are required to exploit the flaw.