# Fluent Forms <= 6.2.15 - Authenticated (Contributor+) Sensitive Information Exposure via 'theme' Shortcode Attribute

- **ID:** WPSEC-2026-1191
- **Plugin:** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (`fluentform`), https://wordpress.org/plugins/fluentform/
- **Affected versions:** all versions before 6.2.16
- **Fixed in:** 6.2.16 (Update to 6.2.16 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluentform
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1191/

## Description

The Fluent Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'theme' attribute of the fluentform shortcode in all versions up to, and including, 6.2.15, due to the attribute being used as a form meta key or dotted path, with whatever value it reaches printed into the page as styler CSS. This makes it possible for authenticated attackers, with contributor-level access and above, to embed a form and read arbitrary form settings meta, such as notification and integration configuration, in the rendered page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1191/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.16/
- https://wordpress.org/plugins/fluentform/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1191/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.