CVE-2026-5069: Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscriptionid' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2026-5069?
CVE-2026-5069 is a security vulnerability in the Fluent Forms plugin for WordPress that allows incorrect authorization for arbitrary subscription cancellation.
What is the severity of CVE-2026-5069?
The severity of CVE-2026-5069 is classified as medium with a base score of 5.4.
How does CVE-2026-5069 affect users?
CVE-2026-5069 allows authenticated users with Subscriber permissions or higher to cancel subscriptions they do not own due to insufficient authorization checks.
How do I fix CVE-2026-5069?
To fix CVE-2026-5069, upgrade the Fluent Forms plugin to version 6.2.2 or later, where the vulnerability has been addressed.
Which versions of Fluent Forms are affected by CVE-2026-5069?
CVE-2026-5069 affects all versions of the Fluent Forms plugin up to and including version 6.2.1.