Fluent Forms Pro CVE-2026-81296

Exploitation requires the target WordPress site to have Fluent Forms Pro Add On Pack version 6.2.12 or earlier installed and active - no other configuration, feature flag, or non-default setting is required. The CVSS vector (PR:N/AC:L/AV:N/UI:N) confirms no authentication, no special network position, and no user interaction are needed; exploitation is viable against default plugin configurations accessible over the public internet. Exploitation is bounded to integrity impact (I:H): confidentiality of stored data is unaffected (C:N) and service availability is not impacted (A:N) per the CVSS vector. The specific unprotected endpoint or plugin feature is not named in the available data, which prevents defenders from blocking individual routes without disabling the plugin entirely.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) places this firmly as a high-severity integrity threat that is trivially reachable from the public internet with no authentication barrier. The low attack complexity and absence of required privileges mean mass-scanning toolkits could target every publicly discoverable WordPress installation running this plugin without manual effort. EPSS data was not provided in the available intelligence, so quantitative exploitation probability cannot be assessed; however, the attack profile is consistent with vulnerability classes that historically see rapid weaponization. The CVE is not listed in the CISA KEV catalog and no POC code is referenced, so there is no current evidence of active exploitation - defenders should not treat KEV absence as a signal that exploitation is unlikely, since the barrier to exploitation is extremely low. The CVSS scope is unchanged (S:U), limiting blast radius to the plugin's own data; lateral movement to the broader WordPress database or hosting environment would require chaining with another vulnerability.

An unauthenticated attacker scans for WordPress sites exposing the Fluent Forms Pro plugin via standard fingerprinting techniques, then sends a crafted HTTP POST request directly to an unprotected REST API route or AJAX endpoint registered by the plugin. Because no capability check guards the endpoint, the server processes the request as if it came from a privileged user, allowing the attacker to alter form settings, delete or tamper with submission records, or modify plugin configuration - all without any credentials. No public exploit code has been identified at time of analysis, but the absence of authentication and the low complexity of the attack vector make manual exploitation straightforward.