CVE-2025-13748
Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.
| CWE | CWE-639 |
| Vendor | techjewel |
| Product | fluent forms – customizable contact forms, survey, quiz, & conversational form builder |
| Published | Dec 6, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder
Be the first to know when new medium vulnerabilities affecting techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
techjewel / Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
0 ≤ 6.1.7
References
Credits
Md. Moniruzzaman Prodhan