Junglewise Threat Intelligence

CVE-2026-17567: WPManageNinja Fluent Forms IDOR in transaction parameter

CVE-2026-17567 · Severity: medium · CVSS 5.3 · Published 2026-07-31

Executive brief

The Fluent Forms plugin for WordPress, used for creating contact forms and processing payments, contains a security flaw that allows unauthorized access to payment receipts. An attacker can exploit this to view sensitive customer information, including names, email addresses, physical addresses, and order details. This could lead to privacy violations and potential reputational damage for businesses using the plugin to handle transactions.

Technical details

The Fluent Forms plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 6.2.8. The vulnerability exists within the 'transaction' parameter due to missing validation on a user-controlled key. Because submission IDs, form IDs, and transaction timestamps are predictable or observable, unauthenticated attackers can brute-force valid transaction hashes. Successful exploitation allows the retrieval of sensitive payment data, including customer PII and order details. The issue is addressed in version 6.2.9.

Affected products

  • WPManageNinja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.8

Timeline

  • 2026-07-31: advisory: CVE-2026-17567 published by Wordfence/NVD
  • 2026-07-31: disclosed
  • 2026-07-31: patched: Fixed in version 6.2.9

References

Related threats