CVE-2026-17567 describes an insecure direct object reference (CWE-639) vulnerability in the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder WordPress plugin. Versions up to and including 6.2.8 fail to validate the 'transaction' parameter properly, which is user-controlled. This allows unauthenticated attackers to brute-force valid transaction hashes to retrieve sensitive payment receipt information such as customer name, email, billing address, order details, payment method, and status belonging to other users. Because submission ID, form ID, and transaction creation time are observable or guessable, the brute-force space is constrained to approximately 900 candidates per second per (submission, form) pair, making exploitation feasible without authentication.

An attacker can access sensitive payment receipt data of other users without authentication by exploiting the authorization bypass vulnerability. This exposure includes personally identifiable information and payment details, potentially leading to privacy violations and fraud risks. The vulnerability does not impact integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor wpmanageninja regarding patches or mitigations addressing this vulnerability.