EUVD-2026-68782
GHSA-5385-87qp-j5rg
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible via WordPress; PR:L reflects mandatory subscriber account; AC:H retained due to undisclosed conditions limiting exploitation; full CIA impact on successful escalation to admin.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
AnalysisAI
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber-level (or equivalent low-privilege) account on the target site - meaning the site must have user registration enabled or the attacker must obtain credentials through another means. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable attack requiring a low-privilege account but with high attack complexity, and full CIA impact if exploited. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Fluent Forms Pro Add On Pack to a version above 6.2.12 as soon as a patched release is made available by WP Manage Ninja - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fluentformpro/vulnerability/wordpress-fluent-forms-pro-add-on-pack-plugin-6-2-12-privilege-escalation-vulnerability for confirmed fix versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Fluent Forms Pro version 6.2.12 or earlier; if subscriber registration is active, either disable it temporarily or implement role-based access controls restricting subscribers from accessing plugin functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluent Forms Pro Add On Pack
View allAn authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functional
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenti
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today