CVE-2026-100143 in FluentCart Plugin
Summary
by MITRE • 09/30/2026
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in FluentCart versions prior to 1.6.5 represents a critical authentication bypass mechanism rooted in flawed session management and identity verification logic during the guest checkout process. The core technical flaw lies in the application's failure to validate ownership of the email address provided by an unauthenticated user attempting to complete a purchase as a guest. In standard secure implementations, when a system allows for account creation or login via email without prior password authentication, it must employ a verification step such as sending a confirmation link or one-time code to ensure the requester controls that specific inbox. FluentCart’s architecture omitted this essential control, treating any validly formatted email address provided during checkout as an authoritative identifier for user identity and session association. This design oversight creates a direct pathway for account takeover attacks where the attacker does not need prior credentials but only needs knowledge of an existing customer's email address associated with stored records in the database.
From an operational perspective, this vulnerability allows unauthenticated attackers to hijack sessions belonging to legitimate customers who have previously made purchases or saved information on the platform. By supplying a known victim's email during the guest checkout flow, the attacker can trigger the system to associate their current session with that user’s profile data. Consequently, the attacker gains access to sensitive personally identifiable information stored within the customer record, such as shipping addresses, phone numbers, and potentially other historical transaction details depending on how much data is exposed in the post-login view or API responses. This constitutes a severe breach of confidentiality for end-users and undermines the integrity of the e-commerce platform’s user management system. The impact extends beyond mere privacy violation; it can lead to fraudulent activities where an attacker uses the victim's stored payment methods if they are available, manipulates order history, or exploits trust relationships within customer support channels by impersonating a legitimate account holder.
This flaw aligns closely with CWE-287 Improper Authentication and CWE-640 Weak Password Recovery Mechanisms for Forgotten Passwords, as it involves the improper handling of identity verification during an authentication-like event. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates Account Manipulation (T1098) by allowing unauthorized actors to establish persistent access under a legitimate user's guise and potentially Credential Access if stored credentials are exposed through subsequent interactions or data dumps enabled by the hijacked session. The lack of email ownership verification is a fundamental deviation from secure coding practices recommended for any system handling sensitive customer data, particularly in high-value transactions where trust and identity assurance are paramount.
Mitigation strategies must focus on implementing robust proof-of-possession mechanisms before associating sessions with existing user accounts. Developers should enforce the sending of a time-limited, single-use verification link to the provided email address during guest checkout if that email corresponds to an existing account in the database. The session should remain unauthenticated and isolated until the user clicks this link or enters the code sent via SMS or email. Additionally, implementing rate limiting on login attempts and adding CAPTCHA challenges can help mitigate automated exploitation of this flaw. For immediate remediation, upgrading to version 1.6.5 or later is required as these versions include patches that enforce proper identity verification protocols during the checkout process, ensuring that only the legitimate owner of an email address can access associated account data through such flows.