The flaw arises because the plugin disables PayPal IPN verification by default. Unauthenticated attackers can send crafted IPN messages to the publicly reachable endpoint, causing the system to treat unpaid submissions as paid and trigger post‑payment actions like emails, access grants, or digital product deliveries. This effectively bypasses payment verification and enables unauthorized access or financial exploitation.

All WordPress sites running the Fluent Forms Pro Add On Pack plugin version 6.1.17 or earlier are affected. The plugin is distributed by TechJewel and is a popular add‑on for the Fluent Forms plugin.

The vulnerability carries a CVSS score of 7.5, indicating high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at the moment. However, the attack can be performed remotely over the public IPN endpoint without authentication, and once the IPN flow is mis‑verified, downstream automation could deliver products or give privileged access. Because it is not yet in the KEV catalog, a broader public campaign is not confirmed, but the potential impact warrants timely remediation.