What is the CVSS score of CVE-2026-5396?

CVE-2026-5396 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fluent Forms are affected by CVE-2026-5396?

Fluent Forms WordPress plugin (versions 6.1.21 and earlier) contains an authorization bypass enabling Fluent Forms Managers to access and modify form submissions beyond their assigned permissions by…

How to fix or mitigate CVE-2026-5396?

Within 24 hours: Identify all Fluent Forms installations running version 6.1.21 or earlier; determine which users hold Fluent Forms Manager role; review recent form submission access logs for anomalies. Within 7 days: Implement granular role-based access controls restricting each manager to assigned forms only; enable comprehensive audit logging of all submission read/modify/delete/annotate operations; restrict direct API access to form submissions. Within 30 days: Apply vendor security patch immediately upon release (subscribe to Fluent Forms security advisories); if patch unavailable, evaluate alternative form management solutions or implement air-gapped handling for sensitive submissions.

Fluent Forms CVE-2026-5396

EUVD-2026-30232 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 security@wordfence.com

GHSA-px32-v334-cgrw

Authentication Bypass WordPress

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:49 vuln.today

CVE Published

May 14, 2026 - 06:16 nvd

HIGH 8.2

DescriptionCVE.org

The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21. This is due to the SubmissionPolicy class authorizing submission-level actions (read, modify, delete, add notes) based on a user-supplied form_id query parameter. This makes it possible for authenticated attackers, with Fluent Forms Manager access restricted to specific forms, to read, modify status, add notes to, and permanently delete form submissions belonging to any other form by spoofing the form_id parameter to a form they are authorized for.

AnalysisAI

Authorization bypass in the Fluent Forms WordPress plugin (versions ≤6.1.21) allows authenticated Fluent Forms Managers to read, modify, annotate, and delete submissions belonging to forms outside their assigned scope by tampering with a user-controlled form_id query parameter. The flaw stems from the SubmissionPolicy class trusting client-supplied input for authorization decisions, granting cross-form access despite role restrictions. No public exploit identified at time of analysis, and EPSS exploitation probability remains low at 0.03%.

Technical ContextAI

Fluent Forms is a popular WordPress contact/survey form plugin that provides a delegated administration model via 'Fluent Forms Manager' role permissions, which can be scoped to specific forms. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the SubmissionPolicy class in app/Http/Policies/SubmissionPolicy.php evaluates whether a caller may act on a submission by reading the form_id directly from the request query string rather than deriving it from the actual submission record or validating it against the manager's assigned form scope. Because the authorization check trusts attacker-controlled input as the resource identifier, supplying any form_id the attacker is authorized for satisfies the policy while the underlying operation still targets submissions tied to a different form_id in the database.

RemediationAI

Upgrade the Fluent Forms plugin to version 6.2.0 or later, which contains the corrected SubmissionPolicy authorization logic per the Plugin Trac changeset linked above and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/81aad41e-0330-4dff-a5f8-08a108d724f5). Where immediate upgrade is not possible, revoke the Fluent Forms Manager role from any untrusted or externally delegated accounts so that only fully trusted administrators retain submission access - this eliminates the exploitation prerequisite at the cost of removing per-form delegation. As an additional compensating control, audit the wp_fluentform_submissions and related tables for unexpected status changes, added notes, or recent deletions to detect prior misuse, since the vulnerability supports a destructive (delete) operation that the integrity-low CVSS rating understates for environments where submission records are the system of record. Refer also to the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-5396 for tracking.