Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.0 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to read arbitrary files. If allow_url_include is enabled on the server, remote code execution is possible.

This record contains material that is subject to copyright.

Source: Wordfence

Is this an issue we should be worried about?

I really do love FluentForms, it has served me and my clients well, however I painfully learned something when a client recently asked for a PDF of the Data Submitted to look like it's associated Form. I learned painfully, that it takes much more time to create a PDF feed that looks like it's associated Form than it takes to create the Form.

I am asking if there is a way to automatically, or by default generate a PDF Feed that looks like and/or mimics the associate form if not, when can this feature be put in the pipeline to be added. I do see the value in having the flexibility of building a PDF from scratch but I also see the many hours that will be spent as more Clients ask why the PDF generated doesn't look like the associated Form. Thanks much for your excellent tools and hard work creating them is very much appreciated.

I'm trying to automatically deactivate a coupon after it has been successfully used in a form, but my code snippet isn't working as expected. I hope someone here might have an idea.

My Goal:

When a customer uses a one-time coupon in my booking form and completes the payment, I want the status of that coupon to be automatically changed from 'active' to 'inactive' in the database to prevent it from being used again.

My Approach:

I'm using the fluentform/after_transaction_status_change hook. My logic is to get the coupon code from the submitted form data and then run a $wpdb->update query on the wp_fluentform_coupons table.

Here is the exact snippet I am using in WP Codebox:

PHP

<?php
/**
 * Deactivates a coupon after it has been used in the booking form.
 */
add_action('fluentform/after_transaction_status_change', function ($new_status, $submission, $transaction_id) {

    // --- Configuration ---
    // The ID of my booking form
    $booking_form_id = 99; // I have set my correct form ID here

    // The name attribute of my coupon field
    $coupon_field_name = 'coupon'; 
    // ---------------------

    // Only run for the booking form and on successful payment
    if ($submission->form_id != $booking_form_id || $new_status !== 'paid') {
        return;
    }

    $formData = (array) $submission->response;

    // Check if a coupon was used in this submission
    if (!empty($formData[$coupon_field_name])) {

        $used_coupon_code = sanitize_text_field($formData[$coupon_field_name]);

        $table_name = $GLOBALS['wpdb']->prefix . 'fluentform_coupons';

        // This is the part that should deactivate the coupon
        $GLOBALS['wpdb']->update(
            $table_name,
            ['status' => 'inactive'],  // The new data
            ['code' => $used_coupon_code]  // The WHERE clause
        );
    }

}, 10, 3);

The Problem:

The form submission and payment work perfectly. The customer gets the discount. However, the coupon's status in the wp_fluentform_coupons table remains 'active'. The UPDATE query does not seem to have any effect.

My Question:

Is fluentform/after_transaction_status_change the correct hook to use for updating the database after a transaction? Is it possible that the action runs in a context where $wpdb->update might fail silently? Or is there a better, more reliable hook for deactivating a coupon after it has been successfully redeemed?

Any ideas or examples would be greatly appreciated!

Thank you, Manuel

I can see a minor update of 6.1, but I can't see the detail of the changes.

What changed?

Thanks!

I love using FluentForms and the flexibility that it gives me. There are 2 features, however that drive me a bit bonkers and hope that they can be addressed or perhaps maybe with FluentCart it will solve itself.

I used FluentForm mostly to collect registrations for horse shows and clinics. I use both inventory feature and payment items.

For horse shows, oftentimes someone will submit their entry and then decide that they need to change a class. In other form tools that I've, I'm able to go to their entry and edit. With FluentForms I can edit some areas but not the payment items. It would be nice if I could update that.

For clinics, I use the inventory as I don't want to oversell. This works great, except for when someone decides to cancel. I haven't been able to figure out how to update the inventory to show space as now available. I've tried cancelling and deleting. I have to manually add one more to the inventory. This is unfortunate as it's no longer an automated process.

Those are just a couple of tweaks for me. But overall love all of the products.

Hi everyone,

I'm trying to automatically generate a unique coupon after a successful payment, but my custom function doesn't seem to be running at all, and I'm hoping someone can spot what I'm doing wrong.

My Goal: When a customer buys a product from my form (ID 5), I want to create a unique coupon with the value of that product.

What I've Tried: I'm using the following PHP code, which includes error_log statements for debugging. My form ID is 5, and the payment field's name attribute is payment_input.

PHP

<?php

add_action('fluentform/payment_success', function ($entryId, $formData, $form, $paymentData) {

    // --- My Configuration ---
    $target_form_id = 5; 
    $payment_field_name = 'payment_input';
    // -------------------------

    error_log('--- Fluent Form Payment Hook started for Form ID: ' . $form->id . ' ---');

    // Only run for the target form
    if ($form->id != $target_form_id) {
        error_log('ERROR: Hook triggered for the wrong form ID: ' . $form->id);
        return;
    }
    error_log('INFO: Correct form ID (' . $target_form_id . ') detected.');

    // Check if the payment field has data
    if (empty($formData[$payment_field_name]) || !is_array($formData[$payment_field_name])) {
        error_log('ERROR: Payment field "' . $payment_field_name . '" not found or is empty.');
        error_log('INFO: Available form data keys: ' . print_r(array_keys($formData), true));
        return;
    }
    error_log('INFO: Payment field "' . $payment_field_name . '" found.');

    // Loop through each purchased item
    foreach ($formData[$payment_field_name] as $item) {
        error_log('INFO: Processing item: ' . print_r($item, true));

        $product_value = floatval($item['value']);

        if ($product_value <= 0) {
            continue;
        }

        // Generate the code and insert into the database...
        // ... (rest of the coupon creation logic)
    }
}, 10, 4);

// ... (helper function to generate the code is also included)

The Problem:

I have placed the code in [PLEASE SPECIFY HERE: for example, "my active child theme's functions.php file" or "the Code Snippets plugin and the snippet is active"].

1. I run a test transaction with Stripe.
2. The payment is successful, and the entry status in Fluent Forms correctly changes to "Paid".
3. I have enabled WP_DEBUG and WP_DEBUG_LOG in my wp-config.php file.
4. However, absolutely none of the error_log messages from my script appear in the /wp-content/debug.log file. The log file only shows unrelated notices from other plugins.

This tells me that the function is not being executed at all. The fluentform/payment_success action is not being triggered for my code.

My Question:

How does this really work? Can anyone see what I'm doing wrong?

• Is there a common mistake in how or where this kind of code should be placed that would prevent it from running?
• Is there a known issue with the fluentform/payment_success hook that I should be aware of?
• What is the definitive, correct way to implement a function that should trigger after a successful payment?

I feel like I'm missing one crucial step, and I'd be very grateful for any advice or insight.

Thanks in advance!

Hi - I have made several polling forms which I use on my blog articles. Reports show the results in charts, and now I'm curious if I could also publish the results of my polling in the article as a chart? I know, I could take a screenshot, but that is static.

I need to rollback Fluent Forms (free & pro) to yesterday's versions while I send in a tech support ticket. Anyone happen to have a link to those versions (or any versions from this week) before I switch to a database backup? THX!

What works better for you (avoiding spam/bots)?

I want to make a form to put on my website.
It is a form with questions for someone to get a recommendation which course to start.
I use HTML code in the answers with conditional logic.
Therefore, people do not need to submit the form to see their choice.
Is it possible to remove the send button?