{
 "id": "WPSEC-2026-1192",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1192/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1192/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1192/index.md",
 "title": "Fluent Forms <= 6.2.15 - Unauthenticated Insecure Direct Object Reference via Guest Order Payer Email",
 "description": "The Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference via the guest payment payer email in all versions up to, and including, 6.2.15, due to payment submissions and transactions being linked to and listed for user accounts based on an unverified, user-supplied payer email. This makes it possible for unauthenticated attackers to attach guest orders to another registered user's account. On sites where an account can be registered without confirming the email address, it also lets an attacker who registers with a victim's email have the victim's guest orders and transactions assigned to and listed for their account.",
 "plugin": {
  "slug": "fluentform",
  "name": "Fluent Forms",
  "full_name": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/fluentform/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluentform/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluentform"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.2.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.2.16"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.2.16",
 "remediation": "Update to 6.2.16 or later.",
 "fix_released": "2026-10-16T13:59:08+00:00",
 "published": "2026-10-17T14:43:07+00:00",
 "updated": "2026-10-17T09:24:45.497777+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1192/",
  "https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/",
  "https://wordpress.org/plugins/fluentform/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluentform",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-17"
 }
}