Fluent Forms CVE-2026-5069

Exploitation requires the attacker to hold a valid WordPress account on the target site at subscriber level or above - meaning the site must permit user registration, or the attacker must have obtained credentials through another means. Additionally, the target site must be using Fluent Forms' payment and subscription features; sites using the plugin solely for contact, survey, or quiz forms are not affected by this specific flaw. The vulnerability is not exploitable by unauthenticated users. Exploitation is limited to cancelling subscriptions - confidentiality is not impacted, and no privilege escalation or code execution is possible through this path.

The CVSS 3.1 base score of 5.4 (Medium) is consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), with low integrity and low availability impact (I:L/A:L) and no confidentiality impact. The practical risk is governed by two factors: first, the attacker must hold a valid WordPress account on the target site (subscriber or higher), limiting exposure to sites with open or low-barrier registration; second, the site must actively use Fluent Forms' payment and subscription functionality - installations using Fluent Forms purely for contact forms are not affected. No EPSS data was provided, no public exploit code has been identified, and the vulnerability is absent from CISA KEV, suggesting no confirmed active exploitation at this time. The real-world business impact - unauthorized cancellation of paying customers' subscriptions - is meaningful for e-commerce sites despite the moderate CVSS score. This is a genuine medium-priority finding for sites with subscriber registration open to the public and active subscription billing.

An attacker with a subscriber-level WordPress account sends crafted AJAX cancellation requests to the Fluent Forms payment endpoint, substituting arbitrary subscription IDs belonging to other users. Because the endpoint validates authentication but not ownership, each request successfully cancels the targeted subscription. No public exploit has been identified at time of analysis, but the attack requires only authenticated HTTP requests with incremented or guessed subscription IDs.