CVE-2026-2428 is a high-severity vulnerability in the Fluent Forms Pro Add On Pack WordPress plugin caused by insufficient verification of data authenticity (CWE-345). The root cause is that the PayPal IPN verification is disabled by default (`disable_ipn_verification` set to 'yes'), which allows attackers to send forged PayPal IPN notifications to the plugin's IPN endpoint. This leads to unauthorized marking of unpaid submissions as paid, triggering automated workflows dependent on payment confirmation. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity but no impact on confidentiality or availability. No known exploits in the wild have been reported, and no patch or official fix is currently available.

An attacker can forge PayPal IPN notifications to the plugin's IPN endpoint, causing unpaid form submissions to be marked as paid. This unauthorized action can trigger post-payment automation such as sending emails, granting access, or delivering digital products without actual payment. This compromises the integrity of payment processing and can lead to financial loss or unauthorized access to paid resources. There is no impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the IPN endpoint or implementing additional verification controls externally. Monitoring for suspicious IPN activity may help detect exploitation attempts. Avoid relying on the default plugin setting that disables IPN verification.