CyberRota Analysis
AI-GeneratedThe FluentCart plugin for WordPress prior to version 1.4.0 is vulnerable as it fails to properly verify subscription ownership, enabling authenticated users to manipulate other customers' subscriptions if they possess the subscription identifier. This could lead to unauthorized changes in payment methods or cancellation of subscriptions, posing a risk to customer data integrity and financial transactions. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.