The Fluent Forms plugin for WordPress up to version 6.1.21 contains an authorization bypass vulnerability (CWE-639) caused by lack of proper validation on the 'submission_id' parameter in the Stripe SCA confirmation AJAX endpoint. This allows unauthenticated attackers to perform insecure direct object reference attacks, modifying payment statuses of pending submissions without proper ownership checks. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact.

An attacker can alter the payment status of pending submissions, potentially disrupting payment processing or causing confusion in transaction records. The vulnerability does not impact confidentiality or availability but can affect the integrity of payment status data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor updates from the vendor and consider restricting access to the affected AJAX endpoint if possible. No official patch or temporary fix is currently documented.