CVE-2026-14926— FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14926
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | FluentCart A New Era of eCommerce | 0 ~ 1.4.0 | - |
II. Public POCs for CVE-2026-14926
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14926
请登录查看更多情报信息。
News Coverage for CVE-2026-14926 (1)
- 🔗 FluentCart < 1.4.0 – Subscriber+ Subscription Payment-Method Tampering via IDOR | CVE 2026-14926 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-28 · 6 CVEs total
| CVE-2026-14924 | Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification | |
| CVE-2026-14870 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id | |
| CVE-2026-14821 | Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion | |
| CVE-2026-14819 | Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move | |
| CVE-2026-14545 | TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Res |
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14924
Tablesome < 1.1.31 - Unauthenticated Post Creation and Modif - CVE-2026-14870
Database for Contact Form 7, WPforms, Elementor forms < 1.5. - CVE-2026-14821
Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Tem - CVE-2026-14819
Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move - CVE-2026-14545
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Acc
V. Comments for CVE-2026-14926
No comments yet