CVE-2025-13748: Fluent Forms Auth Bypass Vulnerability

CVE-2025-13748 Overview

CVE-2025-13748 is an Insecure Direct Object Reference (IDOR) vulnerability in the Fluent Forms plugin for WordPress. The flaw affects all plugin versions up to and including 6.1.7. The submission_id parameter in the confirmScaPayment() function lacks validation on a user-controlled key. Unauthenticated attackers can mark arbitrary form submissions as failed by sending crafted requests to the affected endpoint. Exploitation requires the attacker to guess or enumerate a valid submission identifier. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can tamper with the integrity of Fluent Forms payment submission records, marking arbitrary submissions as failed and disrupting form data workflows on affected WordPress sites.

Affected Products

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress
All versions up to and including 6.1.7
Fixed in version 6.1.8

Discovery Timeline

2025-12-06 - CVE-2025-13748 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13748

Vulnerability Analysis

The vulnerability resides in the confirmScaPayment() function within the Stripe payment processor of the Fluent Forms plugin. The function processes Strong Customer Authentication (SCA) payment confirmation requests but fails to verify that the requester is authorized to act on the referenced submission. The submission_id parameter is accepted directly from user input and used to locate and modify submission records without ownership or session validation. Because the endpoint is reachable without authentication, any remote actor can invoke the function. The affected code path is located in app/Modules/Payments/PaymentMethods/Stripe/StripeInlineProcessor.php, as referenced in the WordPress Plugin Change Log.

Root Cause

The root cause is missing authorization on a user-controlled key, a classic IDOR pattern classified under [CWE-639]. The confirmScaPayment() function trusts the submission_id supplied by the client and performs a state change on the identified record without confirming the caller has any relationship to that submission. No nonce, capability check, or ownership verification gates the operation.

Attack Vector

An unauthenticated attacker sends an HTTP request over the network to the Fluent Forms SCA payment confirmation endpoint. The attacker supplies a guessed or enumerated submission_id value. If the identifier corresponds to an existing submission, the plugin marks that submission as failed. Submission IDs are typically sequential integers, making enumeration straightforward. The attack requires no user interaction and no privileges.

No verified public exploit code is available. The vulnerability mechanism is documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13748

Indicators of Compromise

Unexpected transitions of Fluent Forms submissions to a failed payment state without corresponding legitimate customer activity
Web server access logs containing repeated POST requests to Fluent Forms Stripe SCA confirmation endpoints with sequential or varying submission_id values
Complaints from customers whose completed payments appear as failed in the site backend

Detection Strategies

Audit the Fluent Forms plugin version across all managed WordPress installations and flag any instance at or below 6.1.7
Inspect access logs for anonymous requests referencing the confirmScaPayment action or the Stripe inline processor endpoint
Correlate submission state changes with authenticated administrative activity to identify unauthorized modifications

Monitoring Recommendations

Enable verbose logging on the WordPress admin-ajax and REST API endpoints used by Fluent Forms
Alert on high-frequency requests from a single source targeting payment confirmation endpoints, which indicate enumeration
Monitor database write patterns to the Fluent Forms submissions table for anomalous status field updates

How to Mitigate CVE-2025-13748

Immediate Actions Required

Update the Fluent Forms plugin to version 6.1.8 or later on all WordPress sites
Review historical submission records for unauthorized status changes and restore legitimate entries where needed
Rotate any Stripe API credentials if log analysis indicates suspicious payment endpoint activity

Patch Information

The vendor addressed the flaw in Fluent Forms version 6.1.8. The fix adds validation to the confirmScaPayment() function within StripeInlineProcessor.php, ensuring the caller is authorized to act on the referenced submission_id. Patch details are available in the WordPress Plugin Change Log.

Workarounds

Restrict access to the Fluent Forms Stripe SCA endpoint via web application firewall rules until the plugin is updated
Block anonymous POST requests to the affected endpoint at the reverse proxy or CDN layer
Temporarily disable Stripe inline payment processing in Fluent Forms if patching is not immediately possible

bash

# Example WP-CLI command to update the Fluent Forms plugin to a patched version
wp plugin update fluentform --version=6.1.8