CVE-2026-14926 in FluentCart Plugin
Summary
by MITRE • 07/28/2026
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability resides in the FluentCart WordPress plugin version 1.4.0 and earlier, where insufficient authorization checks exist in multiple payment-method endpoints. This flaw allows authenticated users to manipulate subscriptions belonging to other customers by simply knowing the target subscription identifier, effectively bypassing normal access controls that should restrict actions to only the subscription owner.
The technical implementation fails to enforce proper access control mechanisms when processing subscription-related operations through API endpoints. When a customer makes a request to modify payment methods or cancel/rebind subscriptions, the plugin does not validate whether the requesting user has legitimate authorization to perform these actions on the specified subscription. This represents a classic access control vulnerability where the system trusts the subscription identifier provided by the client without verifying ownership.
This vulnerability enables a range of malicious activities including unauthorized payment method changes that could redirect payments to attacker-controlled accounts, subscription cancellations that disrupt legitimate customer services, and potential re-binding operations that might allow attackers to assume control over future billing cycles. The impact extends beyond simple financial fraud to include service disruption and customer trust degradation.
The flaw directly relates to CWE-285: Improper Authorization, which specifically addresses situations where systems fail to properly verify that authenticated users have appropriate permissions for requested operations. From an adversarial perspective, this vulnerability aligns with ATT&CK technique T1078.004: Valid Accounts, as it exploits legitimate authenticated access to perform unauthorized actions against other customers' accounts.
Organizations should implement immediate mitigations including upgrading to FluentCart version 1.4.0 or later where the authorization checks have been properly implemented. Additionally, administrators should review and monitor subscription-related activities for unusual patterns that might indicate exploitation attempts. The fix typically involves implementing proper ownership verification before executing subscription modification operations, ensuring that each request is validated against the authenticated user's account associations.