Fluent Forms CVE-2026-5395

Requires an authenticated WordPress account with Fluent Forms manager-level capability or higher on a site running Fluent Forms ≤ 6.2.0; the attacker must be able to reach the wp-admin entries export endpoint that calls the exportEntries function. Limiting factors: the manager role is not a default WordPress role and is typically granted only to a small number of operators, no user interaction by another user is needed, and the impact is constrained to data accessible to the WordPress database user (C:H/I:L/A:N - read-oriented, limited integrity, no availability impact). Note that the CVSS vector lists PR:N but the description requires manager-level privileges; treat the description as authoritative.

Signals are mixed and require careful interpretation. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:L/A:N) implies network-reachable, unauthenticated exploitation, yet the description explicitly requires Fluent Forms manager-level access or higher - this is a clear conflict, and the description should be trusted: PR:N in the vector appears to be a scoring artifact. EPSS is very low at 0.03% (9th percentile), there is no CISA KEV listing, and SSVC reports Exploitation: none with Automatable: yes and Technical Impact: partial. Practically, this is a privileged-insider or compromised-manager-account scenario rather than a mass-exploitation candidate, but the Automatable:yes rating means once an attacker has manager access, scripted exfiltration of the entire database is straightforward. Prioritize for sites where Fluent Forms manager roles are delegated to lower-trust users or where account compromise risk is elevated.

An attacker who has obtained Fluent Forms manager credentials - through phishing, credential reuse, or a low-trust internal delegation - logs into wp-admin and invokes the entries export feature while tampering with the form identifier parameter to point at forms owned by other managers or at arbitrary database tables. The export returns CSV data containing the submissions or table contents, and deliberately malformed identifiers surface database error messages that disclose additional table names for further targeting. No public exploit was identified at the time of analysis, but the SSVC Automatable:yes rating indicates the request can be trivially scripted once an attacker has the required role.