Fluent Forms Pro EUVD-2026-58113

Exploitation requires that the site installed the tampered Fluent Forms Pro 6.2.7 build distributed via the decommissioned update server - that install action is the precondition, and clean builds of the same version number are not affected. Once the poisoned build is present, no further authentication or user interaction is needed (CVSS PR:N/UI:N): the implanted backdoor REST endpoint and passwordless administrator account are reachable remotely against a default WordPress deployment. The limiting factor is therefore distribution scope, not attacker skill - only sites that pulled the artifact during the compromise window are exposed, but those sites remain compromised regardless of any hardening applied afterward until the persistence artifacts (mu-plugins/uploads PHP, rogue admin, cron tasks) are fully removed.

This is a genuine top-priority incident rather than an inflated CVSS number: the vulnerability is not theoretical exploitability but the confirmed distribution of live malicious code, so any operator who pulled 6.2.7 from the compromised update server is already compromised at the point of install. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, base 9.3) reflects full confidentiality, integrity and availability loss reachable unauthenticated over the network via the implanted backdoor. There is no EPSS or CISA KEV signal supplied and no separately published exploit PoC, which slightly tempers the 'active mass-exploitation' picture, but that absence is misleading here because the payload ships pre-installed - even a mid-sized municipal IT team in swidnica should treat this as urgent and hunt for the indicators regardless of whether broad scanning is observed. The main uncertainty is the scope of distribution (which sites received the tampered artifact during the compromise window), not whether the code is dangerous.

An administrator updates or installs Fluent Forms Pro 6.2.7 and unknowingly receives the trojanized package from the decommissioned update server; on load, the rogue class-license-sync.php silently registers a backdoor REST endpoint and creates a passwordless admin account. A remote attacker who knows the implant then calls the hidden endpoint unauthenticated (or logs in as the planted admin) to run arbitrary PHP, and even if the operator later deletes the plugin, the mu-plugins payload and scheduled tasks re-establish access. No separate public PoC is required because the attacker's code is already embedded in the shipped build.