Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation

The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 概念验证 WordPress 插件 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder 在所有版本（包括 5.1.16）中，由于 /wp-json/fluentform/v1/global-settings REST API 端点缺少权限检查，容易遭受未授权修改数据的攻击。这使得未经身份验证的攻击者能够修改该插件的所有设置。 先决条件 运行中的 WordPress 站点，已启用 Contact Form –...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 概念验证 适用于 WordPress 的 Contact Form Plugin by Fluent Forms（用于问卷、调查和拖放式 WP 表单构建器）在所有版本直至 5.1.16 中，由于 REST API 端点 /wp-json/fluentform/v1/managers 缺少能力检查，存在权限提升漏洞。这使得未经身份验证的攻击者能够授予用户 Fluent Form 管理权限，从而访问该插件的所有设置和功能。同时，未经身份验证的攻击者也可以删除管理员账号。 前提条件 WordPress 站点已启用 Contact...

CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...

CVE-2026-81297

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68781

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297

Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...

EUVD-2026-68782

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81297 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296

CVE-2026-81296 affects the WordPress plugin Fluent Forms Pro Add On Pack (versions

CVE-2026-81297: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296: Missing Authorization

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

PT-2026-84007

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack = 6.2.12 versions...

PT-2026-84006

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.13 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 6.2.12...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...