CVE-2026-109695

7.5High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-201

Impact

Unauthenticated remote attackers can extract sensitive data directly from application responses. No credentials or user interaction are required.

Root cause

The plugin exposes sensitive internal data by including it in data sent out to clients.

Affected systems

WPManageNinja FluentCart (fluent-cart) through 1.7.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade to a version newer than 1.7.1 once released; if patching is delayed, deactivate the FluentCart plugin.

shell

$ wp plugin update fluent-cart

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.

References

https://patchstack.com/database/wordpress/plugin/fluent-cart/vulnerability/wordpress-fluentcart-plugin-1-7-1-sensitive-data-exposure-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109695