{
 "id": "WPSEC-2026-2294",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2294/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2294/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2294/index.md",
 "title": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Authenticated (Fluent Forms Manager+) Privilege Escalation via Manager Access Management",
 "description": "The Fluent Forms plugin for WordPress is vulnerable to Privilege Escalation via the manager add and remove functionality (the /managers REST endpoint) in all versions up to, and including, 6.2.16, due to a missing check of the acting manager's own form scope before Fluent Forms permissions and form restrictions are attached to or removed from a user. This makes it possible for authenticated attackers who are Fluent Forms managers with full-access permission but restricted to specific forms to lift the form restriction on their own account or another user's, gaining Fluent Forms access to every form and its entries, and to grant or remove manager access for users outside their own scope.",
 "plugin": {
  "slug": "fluentform",
  "name": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
  "full_name": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/fluentform/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluentform/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluentform"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.2.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.2.17"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.2.17",
 "remediation": "Update to 6.2.17 or later.",
 "fix_released": "2026-11-02T10:49:18+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:18.596034+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2294/",
  "https://plugins.svn.wordpress.org/fluentform/tags/6.2.17/",
  "https://wordpress.org/plugins/fluentform/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluentform",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}