FluentCart WordPress plugin arbitrary file deletion

Summary

Insufficient file path validation in the FluentCart WordPress shop plugin lets logged-in users with custom-level access or above delete arbitrary files on the server. All versions up to and including 1.6.2 are affected. Deleting a file such as wp-config.php can lead to remote code execution.

Affected when

• Logged-in account with custom-level access or above

What to do

Check that the plugin runs a version newer than 1.6.2, and read the vendor's advisory. No fixed version is named in the sources.

Products and platforms

• FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler

CVE IDs

• CVE-2026-120577 (opens in a new tab)

Sources

• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 04:43 UTC

First seen 2026-11-09 14:10 UTC