Insufficient Data Verification Vulnerability in Fluent Forms Pro Add On Pack by WordPress
CVE-2026-2428

7.5HIGH

Key Information:

Vendor

WordPress
Status
Fluent Forms Pro Add On Pack
Vendor
CVE Published:
27 February 2026

What is CVE-2026-2428?

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable due to the default configuration of the PayPal IPN verification feature, which is disabled. This configuration allows unauthenticated attackers to exploit the IPN endpoint, sending forged notifications that can falsely mark unpaid submissions as 'paid'. This vulnerability can lead to unauthorized access, triggering post-payment actions such as email dispatches and digital product deliveries without legitimate payment confirmation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Fluent Forms Pro Add On Pack * <= 6.1.17

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://fluentforms.com/docs/changelog/#2-toc-title

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Prickly Cactus
JSON
.