{
 "id": "WPSEC-2026-1191",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1191/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1191/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1191/index.md",
 "title": "Fluent Forms <= 6.2.15 - Authenticated (Contributor+) Sensitive Information Exposure via 'theme' Shortcode Attribute",
 "description": "The Fluent Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'theme' attribute of the fluentform shortcode in all versions up to, and including, 6.2.15, due to the attribute being used as a form meta key or dotted path, with whatever value it reaches printed into the page as styler CSS. This makes it possible for authenticated attackers, with contributor-level access and above, to embed a form and read arbitrary form settings meta, such as notification and integration configuration, in the rendered page.",
 "plugin": {
  "slug": "fluentform",
  "name": "Fluent Forms",
  "full_name": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/fluentform/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluentform/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluentform"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.2.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.2.16"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.2.16",
 "remediation": "Update to 6.2.16 or later.",
 "fix_released": "2026-10-16T13:59:08+00:00",
 "published": "2026-10-17T14:43:07+00:00",
 "updated": "2026-10-17T09:24:45.497777+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1191/",
  "https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/",
  "https://wordpress.org/plugins/fluentform/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluentform",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-17"
 }
}