Wp Manage Ninja
Monthly
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
Broken access control in FluentPlayer Pro (WordPress plugin by WP Manage Ninja) version 1.3.2 and earlier allows authenticated high-privilege users - specifically those with Editor-level roles - to perform integrity-affecting actions that should be restricted to higher authorization tiers. The flaw stems from missing authorization checks (CWE-862) on editor-facing endpoints, enabling unauthorized content modification within the plugin. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Subscriber-level privilege escalation in Fluent Forms Pro Add On Pack (versions <= 6.2.12) allows authenticated users with minimal access to gain significantly elevated permissions within a WordPress installation. Reported by Patchstack against the wp_manage_ninja plugin, the flaw stems from incorrect privilege assignment (CWE-266), meaning subscriber-role accounts can trigger functionality reserved for higher-privileged roles such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible attack vector and high CVSS impact across confidentiality, integrity, and availability make this a meaningful risk for any WordPress site accepting subscriber registrations.
Broken access control in Fluent Forms Pro Add On Pack (versions 6.2.12 and earlier) exposes privileged plugin functionality to unauthenticated remote attackers, allowing unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, low-complexity attack path confirmed by Patchstack, the reporting vendor. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the PR:N/AC:L combination makes this theoretically automatable at scale.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
Broken access control in FluentPlayer Pro (WordPress plugin by WP Manage Ninja) version 1.3.2 and earlier allows authenticated high-privilege users - specifically those with Editor-level roles - to perform integrity-affecting actions that should be restricted to higher authorization tiers. The flaw stems from missing authorization checks (CWE-862) on editor-facing endpoints, enabling unauthorized content modification within the plugin. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.