# Fluent Forms <= 6.2.15 - Unauthenticated Insecure Direct Object Reference via Guest Order Payer Email

- **ID:** WPSEC-2026-1192
- **Plugin:** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (`fluentform`), https://wordpress.org/plugins/fluentform/
- **Affected versions:** all versions before 6.2.16
- **Fixed in:** 6.2.16 (Update to 6.2.16 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluentform
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1192/

## Description

The Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference via the guest payment payer email in all versions up to, and including, 6.2.15, due to payment submissions and transactions being linked to and listed for user accounts based on an unverified, user-supplied payer email. This makes it possible for unauthenticated attackers to attach guest orders to another registered user's account. On sites where an account can be registered without confirming the email address, it also lets an attacker who registers with a victim's email have the victim's guest orders and transactions assigned to and listed for their account.

## References

- https://wpsec.com/vuln/WPSEC-2026-1192/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/
- https://wordpress.org/plugins/fluentform/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1192/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.