{"id":"CVE-2026-100142","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-100142","generatedAt":"2026-10-28T04:14:24.401Z","title":"The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order…","description":"The FluentCart A New Era of eCommerce  WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.","published":"2026-10-22T06:17:12.000Z","lastModified":"2026-10-22T15:16:14.000Z","status":"Deferred","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00298,"percentile":0.22372,"date":"2026-10-27","history":[{"date":"2026-10-22","score":0.00147,"percentile":0.03581}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-22T13:00:14.000Z","detail":{"from":null,"score":"5.3","severity":"MEDIUM","fromSeverity":null},"summary":"Now scored CVSS 5.3 MEDIUM."},{"kind":"new","label":"New CVE","at":"2026-10-22T06:17:12.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-22T06:17:12.237Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://wpscan.com/vulnerability/ef4929d4-c048-413c-885b-0efafdf4e387/","source":"contact@wpscan.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100142","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}