{
 "id": "WPSEC-2026-1190",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1190/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1190/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1190/index.md",
 "title": "Fluent Forms <= 6.2.15 - Authenticated (Fluent Forms Manager+) Cross-Form Authorization Bypass via Malformed 'form_id' Route Parameter",
 "description": "The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the form_id route parameter of its forms, settings, integrations, analytics and report REST endpoints in all versions up to, and including, 6.2.15, due to the FormPolicy and ReportPolicy resolving a form_id with a non-digit suffix to null, which skips the per-form scope check, while the controllers cast the same value back to a real form id. This makes it possible for authenticated Fluent Forms managers who are restricted to specific forms to view, modify and delete forms and form settings they were not granted.",
 "plugin": {
  "slug": "fluentform",
  "name": "Fluent Forms",
  "full_name": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/fluentform/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluentform/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluentform"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.2.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.2.16"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.2.16",
 "remediation": "Update to 6.2.16 or later.",
 "fix_released": "2026-10-16T13:59:08+00:00",
 "published": "2026-10-17T14:43:07+00:00",
 "updated": "2026-10-17T09:24:45.497777+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1190/",
  "https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/",
  "https://wordpress.org/plugins/fluentform/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluentform",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-17"
 }
}