CVE-2025-13748: 
WordPress vulnerability analysis and mitigation

CVE-2025-13748 is an Insecure Direct Object Reference (IDOR) vulnerability in the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress. It affects all versions up to and including 6.1.7, and was published on December 6, 2025. The flaw allows unauthenticated attackers to mark arbitrary form submissions as failed by manipulating the submission_id parameter in the confirmScaPayment() function. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the confirmScaPayment() function accepts a user-supplied submission_id parameter without validating whether the requester is authorized to act on that submission. Because no authentication or ownership check is enforced, any network-accessible attacker can craft a request to the endpoint with a guessed or enumerated submission identifier and alter the submission's payment status to "failed." The fix was introduced in version 6.1.8, as visible in the plugin's changeset for StripeInlineProcessor.php (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to corrupt the integrity of form submission data by marking valid payment submissions as failed, which can disrupt business processes relying on Stripe SCA payment confirmations (e.g., order fulfillment, event registrations, donations). There is no confidentiality or availability impact — the vulnerability is limited to low-severity integrity degradation. However, at scale, systematic manipulation of submission states could cause significant operational disruption for site owners and their customers (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. Exploitation does require the attacker to guess or enumerate valid submission identifiers, which adds a minor practical barrier (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Fluent Forms plugin (version ≤ 6.1.7) using passive techniques such as checking /wp-content/plugins/fluentform/ paths or plugin metadata endpoints.
2. Enumerate submission IDs: Attempt to enumerate valid submission_id values by observing form submission confirmation responses, or by brute-forcing sequential/predictable integer IDs via the vulnerable endpoint.
3. Craft malicious request: Send an unauthenticated HTTP POST or GET request to the Stripe SCA payment confirmation endpoint (handled by confirmScaPayment()) with a valid submission_id belonging to another user's submission.
4. Mark submission as failed: The server processes the request without authorization checks and updates the targeted submission's payment status to "failed," disrupting the associated business workflow (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated POST requests to the Fluent Forms Stripe SCA payment confirmation endpoint (e.g., WordPress AJAX or REST API routes associated with confirmScaPayment) from unexpected or repeated source IPs.
• Logs: WordPress access logs showing repeated requests to the payment confirmation endpoint with varying submission_id values from the same IP, suggesting enumeration attempts.
• Application: Unexpected changes in Fluent Forms submission payment statuses (submissions marked as "failed" that were previously successful), particularly for Stripe SCA payments.

The vendor (Techjewel) released version 6.1.8 of the Fluent Forms plugin, which patches this vulnerability by adding proper authorization validation in the confirmScaPayment() function. Site administrators should update the Fluent Forms plugin to version 6.1.8 or later immediately. No configuration-based workaround is available; upgrading is the only effective remediation (Wordfence, WordPress Trac).

Sucuri included CVE-2025-13748 in its December 2025 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.