The vulnerability arises from a missing validation on the 'submission_id' parameter, allowing an unauthenticated attacker to manipulate the payment status of any submission. Because the confirmScaPayment() function accepts arbitrary IDs, an adversary can craft requests to mark a successful transaction as failed or vice versa, undermining the integrity of payment processing and potentially resulting in financial loss or denial of service for merchants.

WordPress sites running the Fluent Forms plugin version 6.1.7 or earlier. The affected component is the PaymentMethods module of the plugin (StripeInlineProcessor). Users of the plugin across any WordPress installation are at risk.

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting low observed exploitation likelihood. It is not listed in the CISA KEV catalog. The attack surface is through the unauthenticated endpoint that accepts a 'submission_id', so an attacker only needs to guess or enumerate a valid identifier to tamper with payment status. Because no authentication or rate limiting is enforced, exploitation can be performed remotely with minimal effort, but success depends on the likelihood of discovering a usable submission identifier.