CVE-2025-13748

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13748", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-26T15:56:07.294Z", "datePublished": "2025-12-06T06:39:08.515Z", "dateUpdated": "2026-04-08T17:20:12.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:12.805Z"}, "affected": [{"vendor": "techjewel", "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier."}], "title": "Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aee799-4e4c-4a41-8b76-e2ad576fe2e2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Payments/PaymentMethods/Stripe/StripeInlineProcessor.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-11-26T16:13:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-05T18:10:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-08T21:27:32.596858Z", "id": "CVE-2025-13748", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:27:44.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13748", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T21:27:32.596858Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-08T21:27:37.937Z"}}], "cna": {"title": "Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "techjewel", "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-26T16:13:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-05T18:10:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aee799-4e4c-4a41-8b76-e2ad576fe2e2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Payments/PaymentMethods/Stripe/StripeInlineProcessor.php"}], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:20:12.805Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13748", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:20:12.805Z", "dateReserved": "2025-11-26T15:56:07.294Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-06T06:39:08.515Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "vendor": "techjewel", "versions": [{"lessThanOrEqual": "6.1.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier."}, {"lang": "es", "value": "El plugin Fluent Forms - Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 6.1.7, inclusive, a trav\u00e9s del par\u00e1metro 'submission_id' debido a la falta de validaci\u00f3n en una clave controlada por el usuario dentro de la funci\u00f3n confirmScaPayment(). Esto hace posible que atacantes no autenticados marquen env\u00edos arbitrarios como fallidos a trav\u00e9s de solicitudes manipuladas al endpoint, siempre que puedan adivinar o enumerar un identificador de env\u00edo v\u00e1lido."}], "id": "CVE-2025-13748", "lastModified": "2026-10-15T20:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13748", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-08T21:27:32.596858Z", "version": "2.0.3"}}]}, "published": "2025-12-06T07:15:48.220", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Payments/PaymentMethods/Stripe/StripeInlineProcessor.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aee799-4e4c-4a41-8b76-e2ad576fe2e2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:34:21.737338+00:00", "value": {"mitigation_remediation": ["Upgrade the Fluent Forms plugin to version 6.1.8 or later, where input validation on 'submission_id' has been implemented.", "If an upgrade cannot be performed immediately, enforce server\u2011side validation to ensure the 'submission_id' belongs to the current user or session, or block the confirmScaPayment endpoint for unauthenticated requests.", "Add rate limiting or IP restrictions to the payment confirmation endpoint to reduce the feasibility of brute\u2011force enumeration attacks."], "summary": {"action": "Apply Patch", "impact": "Payment Status Tampering"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Fluent Forms plugin version 6.1.7 or earlier. The affected component is the PaymentMethods module of the plugin (StripeInlineProcessor). Users of the plugin across any WordPress installation are at risk.", "description_and_impact": "The vulnerability arises from a missing validation on the 'submission_id' parameter, allowing an unauthenticated attacker to manipulate the payment status of any submission. Because the confirmScaPayment() function accepts arbitrary IDs, an adversary can craft requests to mark a successful transaction as failed or vice versa, undermining the integrity of payment processing and potentially resulting in financial loss or denial of service for merchants.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting low observed exploitation likelihood. It is not listed in the CISA KEV catalog. The attack surface is through the unauthenticated endpoint that accepts a 'submission_id', so an attacker only needs to guess or enumerate a valid identifier to tamper with payment status. Because no authentication or rate limiting is enforced, exploitation can be performed remotely with minimal effort, but success depends on the likelihood of discovering a usable submission identifier."}}}}, "created": "2025-12-08T09:39:41.825744+00:00", "updated": "2026-04-20T21:45:18.960252+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}