CVE-2026-2428

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as "paid" and triggering post-payment automation (emails, access grants, digital product delivery).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-242817.4Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers wh CVE-2026-242825.5Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.CVE-2026-242838.8Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.CVE-2026-242857.0Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-242877.8External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-242886.8Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.CVE-2026-242897.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-24294.9The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` f CVE-2026-242907.8Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.CVE-2026-242917.8Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker t CVE-2026-242927.8Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.CVE-2026-242937.8Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.