EUVD-2026-40919
GHSA-q7hq-w864-jq32
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires authenticated low-privilege account; subscription ID enumeration raises complexity to High; impact is integrity-only with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.
AnalysisAI
Subscription cancellation authorization bypass in the Fluent Forms WordPress plugin (all versions before 6.2.1) permits any authenticated low-privilege user to cancel subscriptions belonging to other site members by submitting a crafted request referencing a victim's subscription identifier. The plugin fails to verify that the requesting user owns the referenced subscription before processing the cancellation, a classic Insecure Direct Object Reference (IDOR) pattern. A public proof-of-concept is available via WPScan; no confirmed active exploitation campaign (CISA KEV) has been identified at time of analysis, and the CVSS base score of 3.1 reflects the limited, integrity-only impact.
Technical ContextAI
Fluent Forms is a widely used WordPress form builder plugin supporting contact forms, multi-step forms, payment and subscription management. The root cause is missing ownership validation on the subscription cancellation endpoint: the plugin accepts a user-supplied subscription identifier and processes the cancellation without confirming the authenticated requester is the owning subscriber - a pattern classified under CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-285 (Improper Authorization), though no CWE is officially assigned in the NVD record. The affected CPE is cpe:2.3:a:unknown:fluent_forms:*:*:*:*:*:*:*:*, covering all versions from 0 up to (not including) 6.2.1. The vendor field in the CPE is listed as 'unknown', which may reflect indexing lag rather than an unverified publisher.
RemediationAI
Update the Fluent Forms WordPress plugin to version 6.2.1 or later, which introduces proper ownership verification before processing subscription cancellation requests; this is the confirmed vendor-released patch per WPScan and EUVD data. Sites where subscriptions carry financial or operational significance should treat this as a priority update even given the low CVSS score. If an immediate upgrade is not feasible, consider using a WordPress role management plugin (such as Members or User Role Editor) to temporarily remove subscription cancellation capabilities from subscriber-level roles - note this may impact legitimate self-service cancellation flows. Alternatively, a WAF rule blocking cancellation endpoint requests from non-admin roles can serve as a compensating control, at the cost of forcing all cancellations through administrative channels. Reference the WPScan advisory at https://wpscan.com/vulnerability/5de7c9e9-3a47-4bc6-a1b2-33eb8d3e3ec0/ for additional technical detail.
More in Fluent Forms
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today