What the vulnerability does
01Description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'submission_id' parameter in versions up to, and including, 6.1.21. This is due to missing authorization and ownership validation on a user controlled key in the Stripe SCA confirmation AJAX endpoint. This makes it possible for unauthenticated attackers to modify payment status of targeted pending submissions (for example, setting the status to "failed").
Explanation of Vulnerability in Simple Terms
02Summary
Fluent Forms versions 6.1.21 and earlier contain an integrity vulnerability allowing unauthenticated attackers to modify data over the network without user interaction. The vulnerability has a CVSS score of 5.3 (medium severity). No confidentiality or availability impact is present. Site administrators should update to a version newer than 6.1.21 when available.
What an attacker can do
03Attacker Capabilities
Modify form data or settings without authentication.
Potential impact on your site
04Site Impact
Form submissions or configurations could be altered by unauthorized parties.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 16, 2026
CVE published
April 16, 2026
Record updated
