CVE-2026-11578: Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR
The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/fluent-formsto a version that resolves this vulnerability.Fixed in 6.2.5 - Configuration
If you have created a Manager restricted to specific forms (non-default configuration mentioned in the issue), remove/adjust that configuration so restricted managers cannot trigger cross-form submission entry deletion.
Fluent Forms WordPress plugin Manager restricted to specific forms configuration = Ensure no managers are configured with restricted-to-specific forms (or remove/adjust the restricted manager role configuration) to avoid the IDOR deletion scenario.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11578?
CVE-2026-11578 has a risk rating of 37, indicating a moderate security concern.
How do I fix CVE-2026-11578?
To fix CVE-2026-11578, update the Fluent Forms WordPress plugin to version 6.2.5 or later.
What does CVE-2026-11578 exploit?
CVE-2026-11578 exploits insufficient access controls in the deletion of form submission entries.
Who is affected by CVE-2026-11578?
Users of the Fluent Forms WordPress plugin prior to version 6.2.5 are affected by CVE-2026-11578.
What is IDOR in the context of CVE-2026-11578?
IDOR, or Insecure Direct Object Reference, refers to the vulnerability allowing unauthorized deletion of form submissions.