CVE-2026-17567: Fluent Forms IDOR Vulnerability

CVE-2026-17567 Overview

CVE-2026-17567 is an Insecure Direct Object Reference (IDOR) vulnerability in the Fluent Forms plugin for WordPress, affecting all versions up to and including 6.2.8. The flaw resides in the plugin's payment transaction handling, where the transaction parameter accepts a user-controlled key without adequate validation. Unauthenticated attackers can brute-force valid transaction hashes to retrieve payment receipt data belonging to other users. Exposed data includes customer name, email address, billing address, order items, payment method, and payment status. The vulnerability is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can enumerate transaction hashes to read customer personally identifiable information (PII) and payment receipt data from any Fluent Forms submission.

Affected Products

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress
All versions up to and including 6.2.8
Fixed in Fluent Forms 6.2.9

Discovery Timeline

2026-07-31 - CVE-2026-17567 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-17567

Vulnerability Analysis

The vulnerability exists in Fluent Forms' payment transaction retrieval logic. When users complete a form submission with a payment component, the plugin generates a transaction record identified by a hash value passed via the transaction URL parameter. The receipt rendering code in TransactionShortcodes.php and PaymentHandler.php fetches the associated transaction record without verifying that the requesting session owns the transaction.

Because the transaction identifier is the sole authorization control, any actor who supplies a valid hash receives the corresponding receipt payload. The plugin does not tie the transaction lookup to a session, nonce, or authenticated user context. The result is that authorization is delegated entirely to knowledge of a guessable value.

Root Cause

The root cause is missing authorization on a user-controlled key [CWE-639]. The BaseProcessor and PaymentHandler components resolve receipts by transaction hash without cross-checking the submission's owner or requiring a per-user secret. The fix in version 6.2.9, visible in the BaseProcessor changeset, tightens validation on the transaction lookup path.

Attack Vector

The attack is remote and unauthenticated over the network. According to the advisory, submission ID, form ID, and transaction creation time are either observable or guessable, which reduces the effective search space to approximately 900 candidates per second per (submission, form) pair. An attacker scripts HTTP requests against the receipt endpoint, iterates candidate transaction hashes, and parses successful responses for PII. No user interaction or account is required. Refer to the Wordfence Vulnerability Analysis for exploitation details.

No verified public proof-of-concept code is available. See the vendor source references for the affected code paths: PaymentHandler.php, BaseProcessor.php, and TransactionShortcodes.php.

Detection Methods for CVE-2026-17567

Indicators of Compromise

High-volume GET or POST requests to Fluent Forms receipt or transaction endpoints containing the transaction parameter from a single source IP within a short window.
Sequential or high-entropy variation of transaction hash values across requests, indicating brute-force enumeration.
HTTP 200 responses to receipt URLs that were never emailed to or requested by a legitimate customer.
Access to Fluent Forms transaction URLs from user agents associated with automation frameworks or absent typical browser fingerprints.

Detection Strategies

Parse web server access logs for requests referencing fluentform transaction endpoints and group by source IP to identify enumeration patterns.
Alert when a single client issues more than a defined threshold of requests to the receipt endpoint with distinct transaction values.
Correlate WordPress database transaction records against web server hits to identify receipt views not linked to a completed customer session.

Monitoring Recommendations

Enable Web Application Firewall (WAF) logging with rules targeting the Fluent Forms receipt endpoint and the transaction parameter.
Monitor egress volume from the WordPress host for anomalous responses containing customer PII fields.
Retain HTTP access logs for at least 90 days to support post-incident triage and enumeration reconstruction.

How to Mitigate CVE-2026-17567

Immediate Actions Required

Update the Fluent Forms plugin to version 6.2.9 or later on all WordPress sites where it is installed.
Audit web server access logs for prior enumeration attempts against Fluent Forms transaction endpoints and identify any exposed customer data.
Notify affected customers where log analysis confirms that receipts were retrieved by unauthorized parties, in accordance with applicable data protection obligations.

Patch Information

The vendor released Fluent Forms 6.2.9, which corrects the authorization flow in the BaseProcessor component. Review the version change log and the BaseProcessor changeset for the specific code changes. Sites should apply the update through the WordPress plugin manager or by pulling the latest release from the WordPress plugin repository.

Workarounds

If patching cannot occur immediately, deploy a WAF rule that rate-limits requests to Fluent Forms receipt endpoints per source IP.
Block requests to the receipt endpoint that lack a valid session cookie or referrer originating from a known post-payment redirect.
Temporarily disable payment receipt shortcodes on public pages until the plugin is updated.

bash

# Example ModSecurity rule to rate-limit access to Fluent Forms receipt endpoint
SecRule REQUEST_URI "@contains transaction=" \
    "id:1026175670,phase:1,pass,nolog,\
    setvar:ip.ff_receipt_count=+1,\
    expirevar:ip.ff_receipt_count=60"

SecRule IP:FF_RECEIPT_COUNT "@gt 20" \
    "id:1026175671,phase:1,deny,status:429,\
    log,msg:'Fluent Forms transaction enumeration suspected (CVE-2026-17567)'"