Fluent Forms CVE-2026-15178

Exploitation requires an authenticated WordPress account with Custom-level capabilities or above on a site running Fluent Forms ≤ 6.2.5; the vulnerable actions are reachable over the network with no user interaction and low complexity once such an account is held. The key limiting factor is the privilege prerequisite (PR:L): sites that only grant Administrator/Editor roles to trusted staff have little exposure, while multi-user deployments (membership, e-commerce, LMS, agency, or guest-contributor sites) that provision lower or custom roles are directly at risk. No special non-default plugin configuration is named as a prerequisite beyond the plugin being installed and active and the attacker possessing a qualifying role.

This is a moderate-severity authorization flaw (CVSS 5.4) that in practice sits below the top-priority tier. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N indicates network-reachable, low-complexity exploitation but explicitly requires authentication (PR:L) - the attacker must already hold a Custom-level WordPress account or higher, which is a meaningful barrier on sites that do not hand out elevated roles freely. Impact is constrained to C:L/I:L/A:N: partial disclosure of private submissions and unauthorized modification/deletion of submission data and plugin settings, with no direct availability impact to the host. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore elevated mainly on multi-user sites (membership, e-commerce, LMS, or agency installs) where low-privilege authenticated accounts are common; on single-admin sites the required privilege sharply limits real-world exposure. Note one tension worth verifying: the input tags label this 'Authentication Bypass,' but the description and CWE-862 (Missing Authorization) make clear it is an authorization (privilege) bypass by an already-authenticated user - not an authentication bypass.

On a WordPress site that assigns Custom-level or higher accounts to non-administrators (e.g., a membership or multi-contributor site), an attacker logs in with their low-privilege account and sends requests directly to Fluent Forms actions that fail to check authorization. With low attack complexity and no user interaction, they read other users' private form submissions, flip submission statuses, permanently delete entries, and tamper with global plugin settings. No public exploit code was identified at time of analysis, but the flaw is trivially reachable once a qualifying account is held.