Vulnerabilities / Fluent Forms / WPSEC-2026-1191
Fluent Forms <= 6.2.15 - Authenticated (Contributor+) Sensitive Information Exposure via 'theme' Shortcode Attribute
Medium 4.3
CWE-200Fixed in 6.2.16
- ID
- WPSEC-2026-1191
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.16
- Remediation
- Update to 6.2.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-17
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'theme' attribute of the fluentform shortcode in all versions up to, and including, 6.2.15, due to the attribute being used as a form meta key or dotted path, with whatever value it reaches printed into the page as styler CSS. This makes it possible for authenticated attackers, with contributor-level access and above, to embed a form and read arbitrary form settings meta, such as notification and integration configuration, in the rendered page.
References
- https://wpsec.com/vuln/WPSEC-2026-1191/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS