CVE-2026-120522: Cloud Storage Manager for Fluent Forms <= 1.2.0 - Unauthenticated Arbitrary File Write via Google Drive Filename Path Traversal

Q: Which installations are affected?

All versions of the WordPress plugin up to and including 1.2.0 are affected. The issue involves the Google Drive integration path.

Q: Does an attacker need a WordPress account or user interaction?

No. The affected REST endpoints lack authorization checks, so exploitation can be performed without authentication or user interaction.

Q: What does an attacker need to exploit the issue?

An attacker can store attacker-controlled Google Drive credentials and trigger a download of an attacker-owned file. Exploitation relies on a provider-returned filename containing path-traversal sequences.

Q: When can this result in remote code execution?

Remote code execution is possible if the attacker writes content with a PHP extension to a web-accessible location. Otherwise, the described impact is arbitrary file write outside the intended downloads directory.

Q: How can I determine whether my site is exposed?

Check whether the Cloud Storage Manager for Fluent Forms plugin is installed and whether its version is 1.2.0 or earlier. Sites using its Google Drive functionality are relevant to the vulnerable download path.

Published Nov 14, 2026

Updated

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the connection/{driver}/save and /download/single-file REST endpoints, combined with insufficient path validation in the Google Drive downloadFile() function, where the Google Drive metadata name value is concatenated into a local path without basename(), sanitizefilename(), or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended downloads directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.

Affected Software

0 affected components

Event History

Nov 14, 2026

CVE Published

via MITRE·12:33 PM

Data Sourced

via MITRE·12:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

All versions of the WordPress plugin up to and including 1.2.0 are affected. The issue involves the Google Drive integration path.

Does an attacker need a WordPress account or user interaction?

No. The affected REST endpoints lack authorization checks, so exploitation can be performed without authentication or user interaction.

What does an attacker need to exploit the issue?

An attacker can store attacker-controlled Google Drive credentials and trigger a download of an attacker-owned file. Exploitation relies on a provider-returned filename containing path-traversal sequences.

When can this result in remote code execution?

Remote code execution is possible if the attacker writes content with a PHP extension to a web-accessible location. Otherwise, the described impact is arbitrary file write outside the intended downloads directory.

How can I determine whether my site is exposed?

Check whether the Cloud Storage Manager for Fluent Forms plugin is installed and whether its version is 1.2.0 or earlier. Sites using its Google Drive functionality are relevant to the vulnerable download path.

CVE-2026-120522: Cloud Storage Manager for Fluent Forms <= 1.2.0 - Unauthenticated Arbitrary File Write via Google Drive Filename Path Traversal

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

Does an attacker need a WordPress account or user interaction?

What does an attacker need to exploit the issue?

When can this result in remote code execution?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does an attacker need a WordPress account or user interaction?

What does an attacker need to exploit the issue?

When can this result in remote code execution?

How can I determine whether my site is exposed?