The vulnerability is an insecure direct object reference that allows an unauthenticated attacker to alter the payment status of pending submissions in the Fluent Forms WordPress plugin. The sole parameter "submission_id" is accepted without proper ownership or authorization checks, enabling an attacker to change a transaction’s state, such as marking a pending payment as failed. This can disrupt the plugin’s financial workflow, potentially leading to revenue loss or incorrect reporting. The weakness is classified under CWE‑639.

Vulnerable software is the Fluent Forms plugin for WordPress, version 6.1.21 and earlier, distributed by the vendor techjewel. No specific WordPress core or other plugin versions are cited. The attacker can target sites running any of these affected plugin versions.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting limited data about real-world exploitation. The vulnerability is not listed in the CISA KEV catalog, implying limited evidence of active exploitation. The likely attack vector is the AJAX endpoint used for Stripe SCA confirmation, which can be accessed without authentication, allowing crafted HTTP requests to manipulate payment states. Because the root cause is missing authorization checks on the submission_id, an attacker who can send arbitrary requests can alter payment states without needing credentials.