Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Authenticated (Fluent Forms Manager+) Privilege Escalation via Manager Access Management
- ID
- WPSEC-2026-2294
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.17
- Remediation
- Update to 6.2.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-269
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Privilege Escalation via the manager add and remove functionality (the /managers REST endpoint) in all versions up to, and including, 6.2.16, due to a missing check of the acting manager's own form scope before Fluent Forms permissions and form restrictions are attached to or removed from a user. This makes it possible for authenticated attackers who are Fluent Forms managers with full-access permission but restricted to specific forms to lift the form restriction on their own account or another user's, gaining Fluent Forms access to every form and its entries, and to grant or remove manager access for users outside their own scope.
References
- https://wpsec.com/vuln/WPSEC-2026-2294/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.17/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS