CVE-2026-120577 in FluentCart Plugin
Summary
by MITRE • 11/03/2026
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The FluentCart plugin, marketed as a modern eCommerce solution for WordPress environments, contains a critical security flaw within its core functionality. Specifically, versions up through 1.6.2 are susceptible to arbitrary file deletion due to insufficient validation of file paths in the deleteFile function. This vulnerability arises because the application fails to properly sanitize or restrict user-supplied input before passing it to system-level file operations. Consequently, an attacker who has obtained authenticated access with custom-level privileges or higher can manipulate these inputs to target files outside of intended directories. The lack of robust path validation allows for directory traversal attacks, enabling the deletion of sensitive system and configuration files that are not part of the plugin's normal operational scope.
The technical nature of this flaw aligns closely with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, often referred to as Path Traversal. By exploiting this weakness, an authenticated attacker can bypass intended access controls and interact directly with the underlying file system. The severity of this vulnerability is significantly amplified by its potential impact on application integrity and availability. While the immediate action is the removal of files, the strategic deletion of critical configuration files such as wp-config.php in a WordPress installation can lead to catastrophic consequences. This specific outcome highlights the risk associated with CWE-78, Improper Neutralization of Special Elements used in an OS Command, particularly when file manipulation leads to further exploitation vectors like Remote Code Execution.
The operational impact of this vulnerability extends beyond simple data loss or service disruption. If an attacker successfully deletes essential configuration files, they may be able to force the application into a state where it becomes vulnerable to other attack methods, such as SQL injection during installation prompts or arbitrary file upload if security checks are bypassed due to missing configurations. Furthermore, the destruction of core system files can render the entire WordPress site inoperable, leading to significant downtime and potential data loss for e-commerce businesses relying on FluentCart for their transactions. This represents a severe threat to business continuity and customer trust, as the integrity of the platform is fundamentally compromised by an authenticated user with relatively low-level privileges.
To mitigate this risk, immediate action is required from site administrators and developers. The primary recommendation is to update the FluentCart plugin to version 1.6.3 or later, where these path validation issues have been addressed. Until the patch is applied, it is advisable to restrict access to WordPress admin areas using strong authentication mechanisms and multi-factor authentication to prevent unauthorized users from obtaining even custom-level access. Additionally, implementing strict file permission settings on the server can limit the damage an attacker might cause by restricting write access to critical directories. Regular security audits and monitoring of file system changes should also be employed to detect any signs of exploitation early. Adhering to industry standards such as OWASP guidelines for input validation and output encoding is essential in preventing similar vulnerabilities in future development cycles, ensuring that all user inputs are rigorously validated against expected formats and allowed paths before being processed by the application.