FluentForm CVE-2026-111831

Exploitation requires only that a site run the FluentForm plugin at version 6.2.15 or earlier and expose the affected plugin endpoint/action to the network - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and default reachability, so no special non-default configuration is documented as a prerequisite. The limiting factors are the plugin's presence at a vulnerable version and the scope of the integrity-only impact: the flaw permits an unauthorized state-changing action but, per C:N/A:N, does not grant data disclosure or denial of service, bounding the damage from a single request.

This is a medium-severity Missing Authorization flaw (CWE-862) in the FluentForm WordPress plugin, affecting all versions up to and including 6.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a network-reachable, low-complexity issue requiring no privileges and no user interaction, but with only a low integrity impact and no confidentiality or availability impact. The unauthenticated, low-complexity nature raises the practical concern, but the limited single-metric impact (integrity-only, likely an unauthorized state change or data modification rather than full compromise) keeps the real-world severity moderate rather than critical. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the exploitation probability cannot be quantified from the available data. Signals are internally consistent (no conflict between the vector and the description, both pointing to remote broken access control). The 'Authentication Bypass' tag is slightly imprecise: this is a missing-authorization/broken-access-control issue (an authenticated action exposed without an authorization check) rather than a credential-level authentication bypass. Net: a real but non-urgent patching priority - act on normal patch cadence, prioritizing internet-facing sites running vulnerable versions.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running FluentForm ≤6.2.15, invoking a plugin action or endpoint that lacks a proper capability/authorization check. Because the integrity impact is limited (CVSS I:L), the attacker can perform an unauthorized state-changing operation - such as modifying form-related data or configuration - but cannot read protected data or take the service down. No public proof-of-concept was identified in the provided data.