A critical vulnerability in the Fluent Forms Pro Add On Pack enables unauthenticated attackers to manipulate payment statuses, potentially leading to unauthorized access or product delivery.

The plugin fails to verify PayPal Instant Payment Notifications because the verification process is disabled by default in the plugin configuration. This allows unauthenticated attackers to send spoofed notifications to the public IPN endpoint, tricking the system into marking unpaid forms as paid.

This vulnerability poses a significant risk to revenue and service integrity, as it allows attackers to bypass payment requirements for forms, digital products, or service access. Given the CVSS score of 7.5, this is classified as a High-severity issue that could result in direct financial loss and the unauthorized granting of sensitive permissions or digital assets.

Immediate Action: Update the Fluent Forms Pro Add On Pack to version 6.1.18 or higher immediately to ensure IPN verification is correctly enforced.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at the PayPal IPN endpoint and review payment logs for discrepancies between form submissions and actual payment confirmations.

Compensating Controls: If an update cannot be applied immediately, utilize a Web Application Firewall to restrict access to the IPN endpoint to only known PayPal IP ranges, effectively preventing external spoofing attempts.

Public Exploit Available: Unknown.

The ability for an unauthenticated user to manipulate business logic regarding payments creates an unacceptable risk to organizational assets. Administrators must verify their current plugin version and apply the vendor patch immediately to prevent potential exploitation of the payment verification flaw.