Fluent Forms < 6.2.1 – Subscriber+ Subscription Cancellation via IDOR | CVE 2026-11880

Description

The plugin does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.

Proof of Concept

Prerequisites: Fluent Forms with the Payments module enabled and a Stripe gateway configured; the global setting "Users can manage their subscriptions" left at its default (enabled); a published page containing the [fluentform_payments] shortcode. A victim user has an active Stripe subscription created through a form. The attacker is any logged-in user (Subscriber) who also has at least one active subscription of their own (so the payments page renders for them).

1. Log in as the attacker (a Subscriber).
2. Visit the page that contains [fluentform_payments]. View source and copy the fluentform_transactions nonce from the inline ff_transactions_vars object ("nonce":"...").
3. Send, with the attacker's session cookies, a request whose subscription_id is the VICTIM's subscription (not the attacker's):

POST /wp-admin/admin-ajax.php
Content-Type: application/x-www-form-urlencoded

action=fluentform_user_payment_endpoints&route=cancel_transaction&subscription_id=<VICTIM_SUBSCRIPTION_ID>&_nonce=<attacker_nonce>

Result on affected versions:
{"success":true,"data":{"message":"Your subscription has been cancelled. Refreshing the page..."}}

The victim's subscription is cancelled even though it belongs to another user. On 6.2.1 and later the same request returns {"success":false,"data":{"message":"Sorry, you can not cancel this subscription at this moment"}}.