What is the CVSS score of CVE-2026-5069?

CVE-2026-5069 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Fluent Forms CVE-2026-5069

EUVD-2026-42778 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-10 Wordfence

GHSA-hmr3-xc3f-vfcx

WordPress Authentication Bypass Fluent Forms Customizable Contact Forms Survey Quiz Conversational Form Builder Wordpress Plugin Wpmanageninja

5.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible AJAX endpoint requires only subscriber auth (PR:L); no confidentiality leak; integrity and availability both low from subscription cancellation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 04:20 vuln.today

CVE Published

Jul 10, 2026 - 02:30 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

AnalysisAI

Incorrect authorization in the Fluent Forms WordPress plugin (versions up to and including 6.2.1) enables any authenticated subscriber-level user to cancel payment subscriptions belonging to other users by supplying an arbitrary 'subscription_id' in the payment cancellation AJAX endpoint. The payment cancellation flow performs no ownership check - only that the user is authenticated - making this a classic IDOR (Insecure Direct Object Reference) under CWE-863. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low bar for exploitation (any registered site account) raises practical risk for sites using Fluent Forms payment/subscription features.

Technical ContextAI

Fluent Forms (CPE: cpe:2.3:a:wpmanageninja:fluent_forms_-_customizable_contact_forms,_survey,_quiz,_&_conversational_form_builder:*:*:*:*:*:*:*:*) is a WordPress form-builder plugin by WPManageNinja that includes payment and subscription management capabilities. The vulnerability root cause is CWE-863 (Incorrect Authorization): the AJAX handler processing payment cancellation requests validates that the caller is authenticated but fails to verify that the authenticated user is the owner of the subscription identified by the 'subscription_id' parameter. This pattern - authority check without ownership check - is a textbook IDOR. Because WordPress AJAX endpoints are accessible over HTTP to any logged-in user, no special network position is required. The changeset at plugins.trac.wordpress.org/changeset/3513845/fluentform indicates the fix was committed to the plugin repository, implying an authorization ownership check was added to the cancellation handler.

RemediationAI

Upgrade the Fluent Forms plugin to a version beyond 6.2.1; the fix has been committed to the WordPress plugin repository as changeset 3513845 (https://plugins.trac.wordpress.org/changeset/3513845/fluentform), though the exact patched release version is not independently confirmed from the available data - verify via the WordPress plugin changelog or Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9. As a compensating control prior to patching, administrators can disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining the subscriber-level access required for exploitation; note this will prevent new account creation site-wide. Alternatively, if subscription/payment features of Fluent Forms are not actively in use, disabling that feature module reduces the attack surface without affecting form functionality.