Now officially on WordPress.org

CVE Database / CVE-2026-4160

CVE · Medium

CVE-2026-4160 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.2.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-4160 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.2.0 Authorization Bypass Through User-Controlled Key Medium 5.3 < 6.2.0 6.2.0 2026-04-16 —

CVE-2026-4160

The Fluent Forms plugin versions up to 6.1.21 is susceptible to Insecure Direct Object Reference vulnerabilities through the 'submission_id' parameter in its Stripe SCA confirmation AJAX endpoint. Without proper authorization and ownership checks on this user-controlled key, unauthenticated attackers can alter the payment status of specific pending submissions, potentially marking them as failed.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings