Fluent Forms CVE-2026-17567

Exploitation requires that the WordPress site has Fluent Forms version 6.2.8 or earlier installed AND has the payment integration module actively configured with real transaction records present. The attacker must be able to identify or infer a valid (submission ID, form ID) pair - these values are frequently surfaced in order confirmation page URLs or email receipt metadata visible to any user who completes a form. The effective limit on exploitation is the need to correctly pair submission and form IDs before iterating timestamps; sites with very low transaction volume offer fewer valid targets, while high-volume e-commerce installations present a proportionally larger and more valuable attack surface. No authentication is required - the CVSS vector PR:N/AV:N/AC:L confirms fully unauthenticated network exploitation against any reachable WordPress installation meeting the above conditions.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) classifies this as Medium, and the C:L metric accurately reflects that only specific transaction records - not the full database - are exposed. However, the real-world severity for payment-enabled WordPress sites exceeds what this score communicates: the exposed fields (name, email, billing address, payment method, payment status) constitute PII and financial data subject to GDPR, CCPA, and PCI-DSS notification obligations. The AC:L metric is well-justified - the description confirms that the observable inputs reduce brute-force to ~900 candidates per second, which is practical without specialized tooling. No KEV listing and no confirmed public POC exist at time of analysis, which modestly reduces urgency for sites with low transaction volume. Sites processing significant payment volume present a larger and more rewarding attack surface. There is no conflict between the CVSS vector and the description - both confirm unauthenticated network exploitation - but defenders should weight the compliance exposure more heavily than the numeric score alone implies.

An unauthenticated attacker identifies a WordPress site running Fluent Forms 6.2.8 or earlier with active payment forms. By observing a submission ID and form ID from a publicly visible order confirmation page, the attacker iterates through plausible creation timestamps at approximately 900 hash candidates per second until the transaction receipt endpoint returns a populated response, revealing the victim customer's name, email, billing address, and payment details. No public POC has been identified at time of analysis, but the detailed exploitation mechanics in the CVE description are sufficient to construct an automated script.