CVE-2026-14926 FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
Authenticated users can tamper with other customers' subscriptions due to missing ownership checks in payment endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14926?
CVE-2026-14926 is a medium-severity missing authorization vulnerability in Unknown FluentCart A New Era of eCommerce, published on 28 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
Weakness: CWE-284
Which versions are affected by CVE-2026-14926?
How do I fix CVE-2026-14926?
No fix has been published for CVE-2026-14926 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-14926 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14926 exists.
Sources
Also known as GHSA-xch7-4rqw-9w56.