What is the CVSS score of CVE-2026-17567?

CVE-2026-17567 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Fluent Forms CVE-2026-17567

EUVD-2026-51517 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-31 Wordfence

GHSA-gx6f-fm4p-x72r

WordPress Authentication Bypass Fluent Forms Customizable Contact Forms Survey Quiz Conversational Form Builder Wordpress Plugin Wpmanageninja

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable, no auth, low complexity due to bounded brute-force; C:L because exposure is scoped to individual transaction records, not full component confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 10:51 vuln.today

CVE Published

Jul 31, 2026 - 09:32 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account.

AnalysisAI

Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.

Technical ContextAI

Fluent Forms (CPE: cpe:2.3:a:wpmanageninja:fluent_forms_-_customizable_contact_forms,_survey,_quiz,_&_conversational_form_builder:*:*:*:*:*:*:*:*) is a WordPress form builder plugin that includes an integrated payment module. The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key): the plugin exposes a 'transaction' parameter in payment receipt lookups without binding the resolved record to the authenticated session or verifying that the requesting party is the rightful owner. Affected code spans three files within the Payments module: BaseProcessor.php (payment processing logic), TransactionShortcodes.php (receipt rendering via shortcodes), and PaymentHandler.php (request routing). The transaction hash is not cryptographically random relative to its inputs - it is seeded with the submission ID, form ID, and creation timestamp, all of which are either surfaced in confirmation pages or constrained to a narrow time window, yielding a practically searchable space without any authenticated context.

RemediationAI

Upgrade Fluent Forms to version 6.2.9 or later; the fix is corroborated by the WordPress plugin repository changeset between tags 6.2.8 and 6.2.9 (https://plugins.trac.wordpress.org/changeset?old_path=%2Ffluentform/tags/6.2.8&new_path=%2Ffluentform/tags/6.2.9) and the specific patch commit to BaseProcessor.php (changeset 3625751 at https://plugins.trac.wordpress.org/changeset/3625751/fluentform/trunk/app/Modules/Payments/PaymentMethods/BaseProcessor.php). If immediate upgrade is not possible, disabling the payment integration feature entirely is the most effective compensating control, though it removes payment form functionality. WAF or rate-limiting rules targeting the transaction receipt endpoint (restricting to a small number of requests per IP per minute) can raise the cost of brute-force attempts but do not eliminate the IDOR root cause and can be bypassed with IP rotation. Wordfence paid-tier customers should verify that the corresponding firewall rule is active; see the advisory URL above.