The Fluent Forms plugin for WordPress contains an authorization bypass vulnerability (CWE-639) due to missing validation on a user-controlled key ('submission_id') in the confirmScaPayment() function. This allows unauthenticated attackers to manipulate the status of arbitrary form submissions by exploiting an insecure direct object reference. The vulnerability affects all versions up to and including 6.1.7. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker can mark arbitrary form submissions as failed without authentication by exploiting the insecure direct object reference vulnerability. This impacts the integrity of submission data but does not affect confidentiality or availability. The ability to guess or enumerate valid submission IDs is required for exploitation. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected endpoint or implementing additional validation controls to prevent unauthorized manipulation of submission statuses. Monitor vendor channels for updates and apply patches promptly once available.