CVE-2026-5069 Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscriptionid' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated...

PT-2019-19936 · Harmis · Harmis Je Messenger

Name of the Vulnerable Software and Affected Versions: Harmis JE Messenger component version 1.2.2 Description: An issue was discovered in the Harmis JE Messenger component for Joomla!, allowing an action to be performed within the context of another user's account. Recommendations: For version...