CVE-2026-2428highCWE-345

CVE-2026-2428: high-severity vulnerability in techjewel Fluent Forms Pro Add On Pack

Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification

Published · Updated

Follow this CVE+ Monitor Fluent Forms Pro Add On Pack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.2%
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as "paid" and triggering post-payment automation (emails, access grants, digital product delivery).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
techjewel · Fluent Forms Pro Add On Pack
Related CVEs — techjewel Fluent Forms Pro Add On Pack

In the same product, most dangerous first.

CVE-2026-15962HIGHFluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta FieldEPSS 0.5%CVE-2026-2365HIGHFluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form SubmissionEPSS 0.3%CVE-2026-2899MEDIUMFluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment DeletionEPSS 0.3%CVE-2026-0632MEDIUMFluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'EPSS 0.2%