Description
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to send forged PayPal IPN notifications to the publicly accessible IPN endpoint, marking unpaid form submissions as "paid" and triggering post-payment automation (emails, access grants, digital product delivery).
INFO
Published Date :
2026-02-27T03:23:19.329Z
Last Modified :
2026-04-08T17:29:56.825Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2026-2428 vulnerability.
| Vendors | Products |
|---|---|
| Techjewel |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-2428.
