Insecure Direct Object Reference in Fluent Forms Stripe Payment Confirmation

The Stripe SCA payment confirmation endpoints in Fluent Forms accept a submission_id from the request without verifying that the caller is entitled to act on that submission. An unauthenticated attacker who can guess or enumerate a valid submission identifier can therefore tamper with the payment status of other users’ form submissions, for example marking a pending payment as failed. Sites using Fluent Forms with Stripe payments enabled are affected.

This vulnerability affects the following application versions:

• Fluent Forms – Customizable Contact Forms 6.0.0
• Fluent Forms – Customizable Contact Forms 6.0.1
• Fluent Forms – Customizable Contact Forms 6.0.2
• Fluent Forms – Customizable Contact Forms 6.0.3
• Fluent Forms – Customizable Contact Forms 6.0.4
• Fluent Forms – Customizable Contact Forms 6.1.0
• Fluent Forms – Customizable Contact Forms 6.1.1
• Fluent Forms – Customizable Contact Forms 6.1.2
• Fluent Forms – Customizable Contact Forms 6.1.3
• Fluent Forms – Customizable Contact Forms 6.1.4
• Fluent Forms – Customizable Contact Forms 6.1.5
• Fluent Forms – Customizable Contact Forms 6.1.6
• Fluent Forms – Customizable Contact Forms 6.1.7
• Fluent Forms – Customizable Contact Forms 6.1.9
• Fluent Forms – Customizable Contact Forms 6.1.10
• Fluent Forms – Customizable Contact Forms 6.1.11
• Fluent Forms – Customizable Contact Forms 6.1.12
• Fluent Forms – Customizable Contact Forms 6.1.13
• Fluent Forms – Customizable Contact Forms 6.1.14
• Fluent Forms – Customizable Contact Forms 6.1.15
• Fluent Forms – Customizable Contact Forms 6.1.16
• Fluent Forms – Customizable Contact Forms 6.1.17
• Fluent Forms – Customizable Contact Forms 6.1.18
• Fluent Forms – Customizable Contact Forms 6.1.19