CVE-2026-4160
IDOR Vulnerability in Fluent Forms Plugin Allows Payment Status Manipulation
Publication date: 2026-04-16
Last updated on: 2026-04-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpforms | fluent_forms | to 6.1.21 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Fluent Forms WordPress plugin, specifically in versions up to and including 6.1.21. It is an Insecure Direct Object Reference (IDOR) issue related to the 'submission_id' parameter. Because the plugin lacks proper authorization and ownership checks on this user-controlled parameter in the Stripe SCA confirmation AJAX endpoint, unauthenticated attackers can manipulate the payment status of targeted pending submissions.
For example, an attacker could change the status of a payment submission to "failed" without proper permissions.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to modify the payment status of pending submissions in the Fluent Forms plugin. This could lead to incorrect payment statuses being recorded, such as marking legitimate payments as failed.
Such manipulation can disrupt business operations, cause financial discrepancies, and potentially affect customer trust due to inaccurate payment records.