The flaw is an insecure direct object reference in the 'transaction' parameter of the Fluent Forms plugin. Because the plugin accepts a user-controlled value without validation, an unauthenticated attacker can brute‑force transaction identifiers and retrieve full payment receipt data, including customer names, emails, billing addresses, order items, payment methods and status belonging to other users. This exposes highly sensitive personal and transactional information.

WordPress sites using the WP Manage Ninja "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder" plugin, any version up to and including 6.2.8. The vulnerability is tied to the payment handling components referenced in the plugin source code.

The CVSS score is 5.3, indicating a medium severity issue. The EPSS value is less than 1 %, suggesting that exploit attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is practically viable: an attacker can send unauthenticated HTTP requests to the plugin’s transaction endpoint, leveraging the fact that submission IDs, form IDs, and creation times are observable or guessable. This reduces the brute‑force search space to roughly 900 candidates per second per (submission, form) pair, making exploitation feasible without any prior authentication or user account.