CVE-2026-4160: Fluent Forms Auth Bypass Vulnerability

CVE-2026-4160 Overview

CVE-2026-4160 is an Insecure Direct Object Reference (IDOR) vulnerability in the Fluent Forms plugin for WordPress. The flaw affects the Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin in all versions up to and including 6.1.21. The vulnerability resides in the Stripe Strong Customer Authentication (SCA) confirmation AJAX endpoint, which fails to validate authorization or ownership of the user-supplied submission_id parameter. Unauthenticated attackers can manipulate the parameter to modify the payment status of arbitrary pending submissions, including marking them as failed. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Unauthenticated attackers can tamper with payment statuses of pending form submissions, disrupting Stripe-based transaction workflows on affected WordPress sites.

Affected Products

Fluent Forms plugin for WordPress, versions up to and including 6.1.21
WordPress sites using Fluent Forms with Stripe SCA payment integration
Pending submissions processed through the Stripe SCA confirmation AJAX endpoint

Discovery Timeline

2026-04-16 - CVE-2026-4160 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-4160

Vulnerability Analysis

The vulnerability stems from missing authorization and ownership checks on a user-controlled key in the Stripe SCA confirmation AJAX endpoint of Fluent Forms. The endpoint accepts a submission_id parameter from the request without verifying that the requester owns or is authorized to act on the referenced submission. An attacker who guesses or enumerates valid submission identifiers can issue crafted AJAX requests that alter the payment status of those submissions.

Because the endpoint is reachable without authentication, exploitation does not require a WordPress account on the target site. The impact is limited to integrity of payment status data — confidentiality and availability are not directly affected, which aligns with the partial integrity impact indicated in the CVSS vector. Operationally, attackers can mark legitimate pending payments as failed, disrupting checkout flows and downstream business logic that relies on submission status.

Root Cause

The root cause is a classic [CWE-639] Insecure Direct Object Reference. The Stripe SCA confirmation handler trusts the submission_id value supplied by the client and looks up the corresponding submission record without enforcing an authorization check tied to the current session, nonce, or payment intent ownership. The plugin treats possession of a submission identifier as sufficient proof of access.

Attack Vector

Exploitation occurs over the network through the WordPress AJAX interface (admin-ajax.php or the equivalent REST route exposed by the plugin). The attacker submits a request invoking the Stripe SCA confirmation action with a submission_id value referencing another user's pending submission. The plugin processes the request and updates the targeted submission's payment status. No user interaction is required, and no authentication is needed.

No public proof-of-concept exploit code has been published. Technical remediation details are available in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-4160

Indicators of Compromise

Unauthenticated POST requests to admin-ajax.php with Fluent Forms Stripe SCA confirmation actions referencing varied submission_id values
Unexpected transitions of Fluent Forms submission payment status to failed without a corresponding Stripe webhook event
Bursts of sequential or randomized submission_id parameter values from a single source IP indicating enumeration

Detection Strategies

Audit web server access logs for repeated requests targeting the Fluent Forms Stripe SCA AJAX endpoint with differing submission_id parameters
Correlate Fluent Forms submission status changes against authoritative Stripe payment intent events to identify discrepancies
Deploy a Web Application Firewall (WAF) rule to inspect requests to the plugin's AJAX action and flag those originating without an authenticated session

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and review entries tied to the Fluent Forms Stripe action handler
Alert on anomalous volumes of payment status transitions within short time windows
Monitor for outbound Stripe API call rates that do not match inbound submission activity

How to Mitigate CVE-2026-4160

Immediate Actions Required

Update the Fluent Forms plugin to a version later than 6.1.21 that includes the fix referenced in changeset 3496638
Review historical Fluent Forms submissions for unexplained failed payment statuses and reconcile against Stripe records
Restrict access to admin-ajax.php from untrusted networks where feasible

Patch Information

The vendor addressed the issue in the plugin update referenced by the WordPress Plugin Changeset 3496638. The patch adds authorization and ownership validation on the submission_id parameter in the Stripe SCA confirmation AJAX endpoint. Site operators should upgrade to the first plugin release containing this changeset. Additional remediation context is available in the Wordfence Vulnerability Report.

Workarounds

Temporarily disable the Stripe SCA payment flow in Fluent Forms until the plugin can be updated
Apply a WAF rule that blocks unauthenticated requests to the plugin's Stripe SCA confirmation AJAX action
Reconcile payment statuses directly from Stripe webhooks rather than trusting plugin-side state for downstream automation

bash

# Example WAF rule pattern (ModSecurity-style) to block unauthenticated
# requests to the vulnerable Fluent Forms Stripe SCA AJAX action.
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1004160,msg:'Block CVE-2026-4160 IDOR attempt'"
    SecRule ARGS:action "@rx fluentform.*stripe.*sca" \
        "chain"
        SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"