CVE-2026-4160: Fluent Forms Authentication Bypass Flaw

CVE-2026-4160 Overview

The Fluent Forms plugin for WordPress, a popular customizable contact forms, survey, quiz, and conversational form builder, contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 6.1.21. The vulnerability exists in the Stripe SCA confirmation AJAX endpoint due to missing authorization and ownership validation on a user-controlled key via the submission_id parameter.

This security flaw allows unauthenticated attackers to manipulate payment status of targeted pending submissions without proper authorization, potentially setting legitimate payment statuses to "failed" and disrupting e-commerce transactions.

Critical Impact

Unauthenticated attackers can modify payment status of pending form submissions, potentially disrupting legitimate Stripe payment transactions and causing financial impact to website owners using Fluent Forms for payment collection.

Affected Products

• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress versions up to and including 6.1.21
• WordPress websites utilizing Fluent Forms with Stripe payment integration
• Any web application relying on Fluent Forms Stripe SCA confirmation functionality

Discovery Timeline

• 2026-04-16 - CVE CVE-2026-4160 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-4160

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR). The flaw exists within the Stripe SCA (Strong Customer Authentication) confirmation AJAX endpoint of the Fluent Forms plugin.

The core issue stems from the plugin failing to implement proper authorization checks and ownership validation when processing the submission_id parameter. When a user submits a form with Stripe payment, the system generates a submission record with a unique identifier. The vulnerable endpoint accepts this identifier without verifying that the requesting user has legitimate access to modify that specific submission.

An attacker exploiting this vulnerability can enumerate or guess valid submission_id values and send crafted requests to the AJAX endpoint to alter the payment status of submissions belonging to other users. This could result in legitimate payments being marked as "failed," causing order fulfillment issues and customer confusion.

Root Cause

The root cause of CVE-2026-4160 is the absence of proper authorization controls in the Stripe SCA confirmation AJAX handler. The vulnerable code accepts the submission_id parameter directly from user input and uses it to locate and modify submission records without performing two critical security checks:

1. Authorization Check: The endpoint does not verify whether the requesting user has permission to access or modify submission data.
2. Ownership Validation: The endpoint fails to confirm that the submission belongs to the requesting user or that the user has a legitimate relationship to the transaction.

This allows any unauthenticated user to manipulate submissions by providing arbitrary submission_id values in their requests.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests to the WordPress AJAX handler targeting the Stripe SCA confirmation endpoint. The attack flow typically involves:

The attacker identifies a target WordPress site running a vulnerable version of Fluent Forms with Stripe payment integration. By crafting requests to the AJAX endpoint with manipulated submission_id parameters, the attacker can modify the payment status of pending submissions. For example, an attacker could set the status of legitimate pending payments to "failed," causing order processing failures.

Since no authentication is required, this vulnerability can be exploited remotely by any attacker with network access to the target WordPress site. The attacker would target the WordPress AJAX handler (/wp-admin/admin-ajax.php) with the appropriate action parameter for the Stripe SCA confirmation functionality. For detailed technical information, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-4160

Indicators of Compromise

• Unusual patterns of requests to /wp-admin/admin-ajax.php with Stripe-related action parameters from unauthenticated sources
• Multiple payment status changes to "failed" without corresponding Stripe webhook events
• Anomalous access patterns to form submission endpoints from single IP addresses or ranges
• Unexpected modifications to submission records in the Fluent Forms database tables

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on suspicious AJAX requests targeting Stripe confirmation endpoints
• Configure WordPress audit logging to track changes to form submission payment statuses
• Deploy SentinelOne Singularity to detect and respond to web application exploitation attempts in real-time
• Monitor server access logs for patterns of sequential or enumerated submission_id parameter values

Monitoring Recommendations

• Enable detailed logging for the Fluent Forms plugin and WordPress AJAX handler
• Set up alerts for payment status modifications that do not correlate with Stripe webhook notifications
• Implement rate limiting on AJAX endpoints to prevent automated exploitation attempts
• Use SentinelOne's behavioral AI to identify anomalous application-level attack patterns

How to Mitigate CVE-2026-4160

Immediate Actions Required

• Update Fluent Forms plugin to a version newer than 6.1.21 that contains the security patch
• Review recent form submissions for any unauthorized payment status modifications
• Temporarily disable Stripe payment functionality if immediate patching is not possible
• Implement additional WAF rules to restrict access to the vulnerable AJAX endpoint

Patch Information

The vulnerability has been addressed in versions after 6.1.21. The security patch implements proper authorization checks and ownership validation for the submission_id parameter in the Stripe SCA confirmation AJAX endpoint. The patch changeset is available at the WordPress Plugin Trac.

Administrators should update to the latest version of Fluent Forms through the WordPress plugin repository or by downloading directly from the official source. After updating, verify that all form submissions and payment integrations continue to function correctly.

Workarounds

• Restrict access to admin-ajax.php for unauthenticated users via server configuration or security plugin if Stripe functionality is not required for guest users
• Implement a security plugin that can add nonce verification to AJAX requests
• Configure server-level rate limiting on AJAX endpoints to slow down enumeration attempts
• Consider temporarily using an alternative payment gateway until the patch can be applied