# Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Authenticated (Fluent Forms Manager+) Privilege Escalation via Manager Access Management

- **ID:** WPSEC-2026-2294
- **Plugin:** Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (`fluentform`), https://wordpress.org/plugins/fluentform/
- **Affected versions:** all versions before 6.2.17
- **Fixed in:** 6.2.17 (Update to 6.2.17 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluentform
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2294/

## Description

The Fluent Forms plugin for WordPress is vulnerable to Privilege Escalation via the manager add and remove functionality (the /managers REST endpoint) in all versions up to, and including, 6.2.16, due to a missing check of the acting manager's own form scope before Fluent Forms permissions and form restrictions are attached to or removed from a user. This makes it possible for authenticated attackers who are Fluent Forms managers with full-access permission but restricted to specific forms to lift the form restriction on their own account or another user's, gaining Fluent Forms access to every form and its entries, and to grant or remove manager access for users outside their own scope.

## References

- https://wpsec.com/vuln/WPSEC-2026-2294/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.17/
- https://wordpress.org/plugins/fluentform/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2294/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.