Fluent Forms CVE-2026-4160

Exploitation requires that the target WordPress site has the Fluent Forms plugin installed at version 6.1.21 or earlier AND has the Stripe payment integration configured with SCA (Strong Customer Authentication / 3D Secure) enabled, meaning the Stripe SCA AJAX confirmation endpoint is active. At least one form submission must be in 'pending' payment state for manipulation to have effect. The attacker must be able to supply or guess a valid submission_id value for a target pending submission - how guessable these IDs are (sequential integers, UUIDs, etc.) is not confirmed in available data and materially affects exploitability. No authentication is required (CVSS PR:N); no user interaction is required (CVSS UI:N). Exploitation is limited to integrity impact only (setting payment status) - no data exfiltration or code execution is possible. Sites that do not use Fluent Forms' Stripe SCA payment integration are not affected by this specific endpoint.

CVSS 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the network-accessible, zero-authentication nature of the flaw but caps impact at Low Integrity because the exploit outcome is limited to payment status manipulation rather than data exfiltration or code execution. EPSS at 0.03% (8th percentile) is very low, consistent with SSVC exploitation status of 'none' - there is no confirmed or observed exploitation. However, SSVC flags the attack as Automatable (yes): an attacker can enumerate submission IDs and submit crafted AJAX requests programmatically without human interaction, making large-scale interference plausible if the plugin is targeted. The business impact of marking legitimate payments as 'failed' - canceled orders, disrupted checkout flows, manual reconciliation burden - may exceed the raw CVSS integrity score suggests for e-commerce sites relying on Fluent Forms + Stripe. Confidentiality and availability impacts are nil per both CVSS and the description. This is a genuine medium-priority issue for sites using Stripe SCA payment collection, but not a high-urgency emergency given the absence of active exploitation or public exploit code.

An attacker with no credentials enumerates or guesses pending Stripe SCA submission IDs - which may follow a predictable or sequential pattern - then sends a crafted unauthenticated AJAX POST request to the Fluent Forms Stripe SCA confirmation endpoint specifying the victim's submission_id with a 'failed' status payload. Because the endpoint performs no ownership or authorization check, the server accepts and persists the tampered status, causing the legitimate buyer's payment submission to be marked failed and potentially canceling their order without any interaction from the site owner or the buyer.