Vulnerability · Published Feb 27, 2026 · Assigned by Wordfence
CVE-2026-2428Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification
High 7.5
In plain English
A high-severity insufficient verification of data authenticity in Fluent Forms Pro Add On Pack from techjewel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as "paid" and triggering post-payment automation (emails, access grants, digital product delivery).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| techjewel | Fluent Forms Pro Add On Pack | 0 – through 6.1.17 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N