AutomatorWP EUVD-2026-96284

Requires an authenticated WordPress account with subscriber-level privileges or higher (PR:L), and the AutomatorWP Fluent Forms integration must be active alongside the Fluent Forms plugin - the vulnerable AJAX handler lives in the plugin's fluentform integration. Exploitation is limited by the need for a valid low-privilege account, so sites that disable open user registration raise the barrier; no user interaction or elevated privileges are needed beyond that. The disclosed data is restricted to Fluent Forms form IDs and titles from the fluentform_forms table, not form submissions or configuration.

This is a genuinely low-priority issue despite being network-exploitable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) correctly characterizes it: an authenticated attacker holding only subscriber-level access can enumerate Fluent Forms records (form IDs and titles) due to a missing authorization check (CWE-862). The impact is limited to confidentiality (C:L) - no integrity or availability effect - and the leaked data (form IDs and titles) is low-sensitivity metadata, not submissions or credentials. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of real-world exploitation. The signals are internally consistent (low CVSS, limited impact, authenticated precondition), so there is no high-CVSS-but-low-risk contradiction to resolve here - it is simply a low-severity information-exposure flaw. The main residual risk is on sites that freely grant subscriber accounts (e.g., open registration), where the barrier to the authenticated precondition is effectively trivial. EPSS/KEV/POC data is absent rather than conflicting; absence is not evidence of safety but given the low impact it does not elevate priority.

An attacker registers or obtains a subscriber-level account on a WordPress site running AutomatorWP (≤5.8.4) with the Fluent Forms integration, then invokes the plugin's unprotected AJAX endpoint to retrieve a list of all Fluent Forms, including their IDs and titles. This reconnaissance data could inform follow-on targeting of specific forms, though no code execution or data modification results. No public exploit code was identified in the provided data.