Fluent Forms Pro EUVD-2026-68782

Exploitation requires a valid WordPress subscriber-level (or equivalent low-privilege) account on the target site - meaning the site must have user registration enabled or the attacker must obtain credentials through another means. The CVSS AC:H metric indicates an additional condition beyond attacker control must be satisfied; the exact nature of this condition (e.g., a specific plugin configuration, active payment integration, or operational state) is not disclosed in the available data and should be confirmed with the vendor advisory. Sites that disable open user registration and restrict account creation to administrators are not exploitable remotely without prior credential compromise. The flaw is limited to WordPress environments with Fluent Forms Pro Add On Pack active and versions at or below 6.2.12.

The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable attack requiring a low-privilege account but with high attack complexity, and full CIA impact if exploited. The AC:H metric is significant: it constrains real-world risk, implying that specific conditions beyond attacker control must be met - possibly a non-default plugin configuration, a race condition, or a specific operational state. Despite high CIA impact in the CVSS vector, the AC:H component means opportunistic mass exploitation is less likely. No EPSS data was provided; without it, the exploitation probability cannot be quantified independently. There is no KEV listing and no confirmed public exploit, indicating this is currently not under active widespread exploitation. However, any WordPress site that allows open subscriber self-registration is meaningfully exposed: a threat actor can trivially create a subscriber account and attempt the escalation chain. Sites restricting registration eliminate the threat entirely.

An attacker registers a free subscriber account on a target WordPress site running Fluent Forms Pro Add On Pack <= 6.2.12, then crafts a specific authenticated request - likely a POST to an AJAX handler or REST endpoint - that exploits the missing capability check to invoke a privileged function. If the attack complexity conditions are met (possibly a particular plugin state or configuration), the attacker achieves elevated access, potentially escalating to administrator role and gaining full control over site content, user accounts, and potentially the underlying server via plugin/theme installation. No public exploit code has been identified at time of analysis.