CVE-2026-17567

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9

Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers can brute-force valid transaction hashes using the transaction parameter to view sensitive payment receipt data of other users, including customer names, email addresses, billing addresses, order items, payment methods, and payment status. This is possible because the submission ID, form ID, and transaction creation time are observable or guessable, limiting the brute-force space to approximately 900 candidates per second per submission and form pair.

Recommendations Update the plugin to version 6.2.9 or later. As a temporary mitigation, restrict access to the transaction parameter to minimize the risk of unauthorized data exposure.