CVE-2025-13748

| EUVD-2025-201540 MEDIUM
2025-12-06 [email protected]
5.3
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Mar 15, 2026 - 17:37 euvd
EUVD-2025-201540
Analysis Generated
Mar 15, 2026 - 17:37 vuln.today
CVE Published
Dec 06, 2025 - 07:15 nvd
MEDIUM 5.3

Tags

Authentication Bypass WordPress PHP

Description

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.

Analysis

A security vulnerability in for WordPress is vulnerable to Insecure Direct Object Reference in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.

Technical Context

CWE-639 (Authorization Bypass (IDOR)). Affects for WordPress is vulnerable to Insecure Direct Object Reference in all.

Affected Products

['for WordPress is vulnerable to Insecure Direct Object Reference in all']

Remediation

Monitor vendor channels for patch availability.

Priority Score

27
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +26
POC: 0

Share

CVE-2025-13748 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy