Fluent Forms <= 6.2.15 - Authenticated (Fluent Forms Manager+) Cross-Form Authorization Bypass via Malformed 'form_id' Route Parameter
- ID
- WPSEC-2026-1190
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.16
- Remediation
- Update to 6.2.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-17
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the form_id route parameter of its forms, settings, integrations, analytics and report REST endpoints in all versions up to, and including, 6.2.15, due to the FormPolicy and ReportPolicy resolving a form_id with a non-digit suffix to null, which skips the per-form scope check, while the controllers cast the same value back to a real form id. This makes it possible for authenticated Fluent Forms managers who are restricted to specific forms to view, modify and delete forms and form settings they were not granted.
References
- https://wpsec.com/vuln/WPSEC-2026-1190/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS