CVE-2026-17567

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account.

• CWE-639

• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.4/app/Modules/Payments/PaymentHandler.php#L218
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.4/app/Modules/Payments/PaymentMethods/BaseProcessor.php#L959
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.4/app/Modules/Payments/TransactionShortcodes.php#L107
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Payments/PaymentHandler.php#L218
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Payments/PaymentMethods/BaseProcessor.php#L959
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.2.8/app/Modules/Payments/TransactionShortcodes.php#L107
• https://plugins.trac.wordpress.org/changeset/3625751/fluentform/trunk/app/Modules/Payments/PaymentMethods/BaseProcessor.php
• https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8&new_path=%2Ffluentform/tags/6.2.9
• https://www.wordfence.com/threat-intel/vulnerabilities/id/565980d7-8dc9-42a4-90c5-2f75af52fb8e?source=cve

Published

Jul 31, 2026

Last Modified

Aug 1, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-17552Plack::App::Prerender versions before 0.3.0 for Perl can pro…9.1
• CVE-2026-17555The WPvivid Backup & Migration plugin for WordPress is vulne…4.9
• CVE-2026-17556A path traversal vulnerability was identified in GitHub Ente…8.8
• CVE-2026-1756The WP FOFT Loader plugin for WordPress is vulnerable to arb…8.8
• CVE-2026-17561Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2026-17566pgAdmin 4's Import/Export Data tool builds a psql \copy (...…9.9
• CVE-2026-17568Improper access control in the role membership management en…8.8
• CVE-2026-17569Improper access control in the NetBox synchronizer in Devolu…4.3
• CVE-2026-1757A flaw was identified in the interactive shell of the xmllin…6.2
• CVE-2026-17570Improper access control in the PAM password history endpoint…4.3
• CVE-2026-17571The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…6.1
• CVE-2026-17572Heap-based buffer overflow in the SOHM list-index deserializ…5.5