Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation

The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...

WordPress Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin <= 1.2.0 - Unauthenticated Arbitrary File Write vulnerability

Unauthenticated Arbitrary File Write vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads versions = 1.2.0...

CVE-2026-120522

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the connection/driver/save and /download/single-file REST...

EUVD-2026-125904

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the connection/driver/save and /download/single-file REST...

CVE-2026-120522

The Cloud Storage Manager for Fluent Forms WordPress plugin (versions up to and including 1.2.0 ) is vulnerable to unauthenticated arbitrary file write via Google Drive filename path traversal. The root cause is a lack of authorization checks on the connection/{driver}/save and /download/single-f...

CVE-2026-120522 Cloud Storage Manager for Fluent Forms <= 1.2.0 - Unauthenticated Arbitrary File Write via Google Drive Filename Path Traversal

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the connection/driver/save and /download/single-file REST...

PT-2026-147412

Name of the Vulnerable Software and Affected Versions Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads versions prior to 1.2.1 Description An arbitrary file write issue exists due to missing authorization checks on the 'connection/driver/save' and...

CVE-2026-120522: fluentwiz: The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is…

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the connection/driver/save and /download/single-file REST...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST A...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Proof-of-Concept The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all...

CVE-2026-119213

The Fluent Support WordPress plugin (versions ≤ 2.4.7 ) is vulnerable to unauthenticated modification of a registered customer's profile fields. The root cause lies in the Fluent Forms integration (FeedIntegration::notify()), which resolves a logged-out submitter's email to a WordPress account vi...

CVE-2026-119213 Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration FeedIntegration::notify opens a ticket fr...

WordPress Fluent Forms Authorization Issue Vulnerability

WordPress Fluent Forms versions 6.2.15 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization mechanisms; attackers could exploit this to exploit improperly configured access control levels...

CVE-2026-110383

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110383 WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110383 WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

EUVD-2026-103426

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110383

The WP E-Signature Electronic Signature Add-on for Fluent Forms plugin (versions n/a through 2.0.5 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This issue stems from incorrectly configured access control security levels , specifically allowing for Insecure...

PT-2026-116594

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110383: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...