{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T19:33:19.499","vulnerabilities":[{"cve":{"id":"CVE-2026-2428","sourceIdentifier":"security@wordfence.com","published":"2026-02-27T04:16:03.600","lastModified":"2026-06-17T10:30:56.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as \"paid\" and triggering post-payment automation (emails, access grants, digital product delivery)."},{"lang":"es","value":"El plugin Fluent Forms Pro Add On Pack para WordPress es vulnerable a la Verificación Insuficiente de Autenticidad de Datos en todas las versiones hasta la 6.1.17, inclusive. Esto se debe a que la verificación de PayPal IPN (Notificación Instantánea de Pago) está deshabilitada por defecto (disable_ipn_verification tiene un valor predeterminado de 'yes' en PayPalSettings.php). Esto permite que atacantes no autenticados envíen notificaciones PayPal IPN falsificadas al endpoint IPN de acceso público, marcando las entregas de formularios no pagadas como 'pagadas' y activando la automatización posterior al pago (correos electrónicos, concesión de accesos, entrega de productos digitales)."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"techjewel","product":"Fluent Forms Pro Add On Pack","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.1.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-27T15:49:08.291600Z","id":"CVE-2026-2428","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://fluentforms.com/docs/changelog/#2-toc-title","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c62e54-da06-4b44-ba70-63065e664b0d?source=cve","source":"security@wordfence.com"}]}}]}