CVE-2025-13748 Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id
Unauthenticated attackers can tamper with payment statuses of arbitrary form submissions by guessing submission IDs in the Fluent Forms WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13748?
CVE-2025-13748 is a medium-severity missing authorization vulnerability in techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder, published on 6 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.
Weakness: CWE-639
Which versions are affected by CVE-2025-13748?
How do I fix CVE-2025-13748?
No fix has been published for CVE-2025-13748 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-13748 being exploited?
There is no known exploitation of CVE-2025-13748 in the wild and no public exploit code.
Sources
Also known as GHSA-wm8p-g36w-qphw.