CVE-2025-13748

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Payments/PaymentMethods/Stripe/StripeInlineProcessor.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aee799-4e4c-4a41-8b76-e2ad576fe2e2?source=cve

Configurations

No configuration.

History

15 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El plugin Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 6.1.7, inclusive, a través del parámetro 'submission_id' debido a la falta de validación en una clave controlada por el usuario dentro de la función confirmScaPayment(). Esto hace posible que atacantes no autenticados marquen envíos arbitrarios como fallidos a través de solicitudes manipuladas al endpoint, siempre que puedan adivinar o enumerar un identificador de envío válido.

Information

Published : 2025-12-06 07:15

Updated : 2026-10-15 20:10

NVD link : CVE-2025-13748

Mitre link : CVE-2025-13748

CVE.ORG link : CVE-2025-13748

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-13748", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13748", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T21:27:32.596858Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "techjewel", "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.1.7"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-06T07:15:48.220", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Payments/PaymentMethods/Stripe/StripeInlineProcessor.php", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aee799-4e4c-4a41-8b76-e2ad576fe2e2?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier."}, {"lang": "es", "value": "El plugin Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 6.1.7, inclusive, a trav\u00e9s del par\u00e1metro 'submission_id' debido a la falta de validaci\u00f3n en una clave controlada por el usuario dentro de la funci\u00f3n confirmScaPayment(). Esto hace posible que atacantes no autenticados marquen env\u00edos arbitrarios como fallidos a trav\u00e9s de solicitudes manipuladas al endpoint, siempre que puedan adivinar o enumerar un identificador de env\u00edo v\u00e1lido."}], "lastModified": "2026-10-15T20:10:00.197", "sourceIdentifier": "security@wordfence.com"}