Vulnerabilities / Fluent Forms / WPSEC-2026-0184
Fluent Forms <= 6.2.13 - Unauthenticated Payment Amount Manipulation via Omitted Payment Inputs and Negative Custom Subscription Amounts
Medium 5.3
CWE-840Fixed in 6.2.14
- ID
- WPSEC-2026-0184
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.14
- Remediation
- Update to 6.2.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to payment amount manipulation in all versions up to, and including, 6.2.13. This is due to insufficient server-side validation of payment order items: server-priced payment inputs that were left out of the submission were skipped, and negative custom subscription amounts were accepted. This makes it possible for unauthenticated attackers to reduce or zero out the total of orders placed through payment-enabled forms.
References
- https://wpsec.com/vuln/WPSEC-2026-0184/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.14/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS