Insecure Direct Object Reference in Fluent Forms Plugin for WordPress
CVE-2025-13748
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 December 2025
What is CVE-2025-13748?
The Fluent Forms plugin used in WordPress is susceptible to an Insecure Direct Object Reference vulnerability that affects all versions prior to 6.1.8. This issue stems from insufficient validation of the 'submission_id' parameter within the confirmScaPayment() function. Unauthenticated attackers can exploit this flaw to manipulate the status of any submission by sending crafted requests to the endpoint, making it possible to falsely mark submissions as failed by simply guessing or enumerating valid submission identifiers.
Affected Version(s)
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder * <= 6.1.7