CVE-2026-120858: WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress FluentForm pluginto a version that resolves this vulnerability.Fixed in 6.2.17
Event History
Frequently Asked Questions
Which FluentForm installations are affected?
FluentForm versions through 6.2.16 are affected. The available information does not identify any configuration prerequisite or excluded deployment type.
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates network-based exploitation with no privileges required and no user interaction required.
What is the expected impact if the issue is exploited?
The stated impact is low confidentiality impact and low integrity impact, with no availability impact. The vulnerability is categorized as broken access control caused by missing authorization.