CVE-2026-2428

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as "paid" and triggering post-payment automation (emails, access grants, digital product delivery).

• CWE-345

• https://fluentforms.com/docs/changelog/#2-toc-title
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c62e54-da06-4b44-ba70-63065e664b0d?source=cve

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24266NVIDIA Triton Inference Server for Linux contains a vulnerab…7.5
• CVE-2026-24268NVIDIA TensorRT contains a vulnerability where an attacker m…7.8
• CVE-2026-2427The itsukaita plugin for WordPress is vulnerable to Reflecte…6.1
• CVE-2026-24270NVIDIA AIStore framework contains a vulnerability where an a…9.8
• CVE-2026-24271NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-c…6.2
• CVE-2026-24272NVIDIA TensorRT contains a vulnerability where an attacker m…7.8
• CVE-2026-24281Hostname verification in Apache ZooKeeper ZKTrustManager fal…7.4
• CVE-2026-24282Out-of-bounds read in Push Message Routing Service allows an…5.5
• CVE-2026-24283Heap-based buffer overflow in Windows File Server allows an …8.8
• CVE-2026-24285Use after free in Windows Win32K allows an authorized attack…7
• CVE-2026-24287External control of file name or path in Windows Kernel allo…7.8
• CVE-2026-24288Heap-based buffer overflow in Windows Mobile Broadband allow…6.8