CVE-2026-4160

OVERVIEW CVE-2026-4160 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Fluent Forms (Customizable Contact Forms plugin) for WordPress through version 6.1.21. The flaw exists in the Stripe SCA confirmation AJAX endpoint, which fails to validate user authorization and ownership of submission records referenced by the 'submission_id' parameter. SEVERITY This vulnerability carries a CVSS 3.1 score of 5.3 (Medium) with a network-based attack vector requiring no privileges or user interaction. The attack complexity is low, meaning exploitation is straightforward. While unauthenticated attackers cannot access sensitive data, they can modify payment statuses on pending submissions, such as marking legitimate payments as failed. This creates integrity risks for e-commerce and form-based payment processing operations. EXPLOITATION STATUS There is currently no evidence of active exploitation. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is inactive on public hot lists. Exploit code availability is not documented. The EPSS score of 0.00037 indicates a relatively low probability of exploitation compared to other CVEs, suggesting limited community attention at present. However, the straightforward nature of IDOR vulnerabilities warrants prompt patching to prevent future exploitation.