Technical impact
The FluentCart WordPress plugin before version 1.5.3 fails to enforce authorization when rendering customer order documents. An unauthenticated visitor can request the print route for a sequential numeric order ID, causing the plugin to reveal sensitive customer data including names, email addresses, billing and shipping postal addresses, and order details. This leads to a confidentiality breach of personal data across the store.
Affected Systems
All installations of the FluentCart plugin with a version less than 1.5.3 are affected. These are WordPress sites using the A New Era of eCommerce version prior to 1.5.3. The vulnerability resides in the order print routes that accept a numeric order ID without verifying ownership or authentication.
Risk and Exploitability
The CVSS score of 3.7 indicates low severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, further suggesting limited public exploitation. An unauthenticated attacker can access order print routes by guessing sequential numeric IDs, revealing personal data without authentication or ownership checks, and no special configuration is required.
