Fluent Forms <= 6.2.15 - Unauthenticated Insecure Direct Object Reference via Guest Order Payer Email
- ID
- WPSEC-2026-1192
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.16
- Remediation
- Update to 6.2.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-17
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference via the guest payment payer email in all versions up to, and including, 6.2.15, due to payment submissions and transactions being linked to and listed for user accounts based on an unverified, user-supplied payer email. This makes it possible for unauthenticated attackers to attach guest orders to another registered user's account. On sites where an account can be registered without confirming the email address, it also lets an attacker who registers with a victim's email have the victim's guest orders and transactions assigned to and listed for their account.
References
- https://wpsec.com/vuln/WPSEC-2026-1192/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS