What is the CVSS score of CVE-2026-4160?

CVE-2026-4160 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Fluent Forms CVE-2026-4160

EUVD-2026-23237 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-16 Wordfence

GHSA-23m2-3g75-jvc8

WordPress Authentication Bypass Fluent Forms Customizable Contact Forms Survey Quiz Conversational Form Builder Wordpress Plugin Techjewel

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated AJAX endpoint with no special attack conditions; impact limited to low integrity (payment status write) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:40 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 14:00 euvd

EUVD-2026-23237

CVE Published

Apr 16, 2026 - 13:27 nvd

MEDIUM 5.3

DescriptionCVE.org

The Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'submission_id' parameter in versions up to, and including, 6.1.21. This is due to missing authorization and ownership validation on a user controlled key in the Stripe SCA confirmation AJAX endpoint. This makes it possible for unauthenticated attackers to modify payment status of targeted pending submissions (for example, setting the status to "failed").

AnalysisAI

Payment status manipulation in the Fluent Forms WordPress plugin (versions up to and including 6.1.21) allows unauthenticated remote attackers to alter Stripe SCA payment submission statuses - for example, forcing a pending payment to 'failed' - by supplying an arbitrary submission_id to an unprotected AJAX endpoint. The vulnerability stems from missing authorization and ownership validation on a user-controlled parameter in the Stripe SCA confirmation flow. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.03%, though SSVC flags the attack as automatable, making bulk interference with payment workflows theoretically feasible at scale.

Technical ContextAI

This is a CWE-639 (Authorization Bypass Through User-Controlled Key) vulnerability, a subclass of IDOR, within the Stripe Strong Customer Authentication (SCA) AJAX confirmation endpoint of the Fluent Forms plugin for WordPress (vendor: techjewel; CPE: cpe:2.3:a:techjewel:fluent_forms_-_customizable_contact_forms,_survey,_quiz,_&_conversational_form_builder:*:*:*:*:*:*:*:*). WordPress AJAX endpoints require explicit capability checks and nonce validation; in this case the endpoint accepts a client-supplied 'submission_id' and acts on the corresponding database record without verifying that the requesting user owns or has any relationship to that submission. The Stripe SCA payment confirmation flow is designed to update submission state after 3D Secure authentication completes, but because the endpoint is accessible to unauthenticated users and the record lookup uses a caller-supplied key with no ownership check, any actor who can enumerate or guess submission IDs can drive state transitions on arbitrary submissions.

RemediationAI

Update the Fluent Forms plugin to a version beyond 6.1.21 via the WordPress admin plugin update mechanism or by applying the patch available in SVN changeset 3496638 (https://plugins.trac.wordpress.org/changeset/3496638/fluentform). The exact released version number containing the fix has not been independently confirmed from available data - verify the installed version in the WordPress plugins dashboard after updating. If an immediate update is not possible, a compensating control is to disable or remove the Stripe SCA payment integration within Fluent Forms until the patch is applied; this eliminates the vulnerable endpoint entirely but will prevent Stripe 3D Secure payment collection. Alternatively, a Web Application Firewall rule blocking unauthenticated POST requests to the specific Fluent Forms Stripe SCA AJAX action can limit exposure, though this requires identifying the exact action name from the plugin source and may interfere with legitimate payment confirmations. Monitoring for anomalous spikes in submission status change events can serve as a detection signal.