WordPress Plugin Vulnerabilities

Fluent Forms < 6.2.9 - Unauthenticated Payment Receipt Disclosure via IDOR

Description

The plugin is vulnerable to Insecure Direct Object Reference due to missing validation on a user controlled key, making it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data belonging to other users, including customer name, email address, billing address, order items, payment method and payment status.

Affects Plugins

Plugin icon
fluentform
Fixed in 6.2.9

References

CVE
CVE-2026-17567
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/565980d7-8dc9-42a4-90c5-2f75af52fb8e

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
ChinhNguyen
Verified
No
WPVDB ID
a5e24330-c865-4d64-990b-28b73d07b7f0

Timeline

Publicly Published
2026-07-30 (about 2 months ago)
Added
2026-07-30 (about 2 months ago)
Last Updated
2026-07-30 (about 2 months ago)

Other

Published
Title
Published
2026-07-23
Title
Kirki < 6.1.0 - Unauthenticated Sensitive Data Disclosure via context Parameter
Published
2024-07-18
Title
GiveWP – Donation Plugin and Fundraising Platform < 3.14.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
Published
2026-05-27
Title
FOX – Currency Switcher Professional for WooCommerce < 1.4.7 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter
Published
2024-01-02
Title
WP 2FA < 2.6.0 - Subscriber+ Arbitrary Email Sending
Published
2026-07-13
Title
Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR