CVE-2026-15178 in Fluent Forms Plugin
Summary
by MITRE • 10/10/2026
The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access and above, to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The Fluent Forms WordPress plugin contains a critical authorization bypass vulnerability affecting all versions up to and including 6.2.5. This security flaw stems from an insufficient verification of user privileges when handling administrative actions within the plugin interface. Specifically, the application logic fails to enforce proper access control checks before executing sensitive operations related to form data management and global configuration changes. As a result, any authenticated user possessing Custom-level access or higher can exploit this deficiency to perform actions that should be restricted to administrators with elevated privilege levels.
The technical nature of this vulnerability aligns closely with CWE-284, which describes Improper Access Control, as well as the ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access to system resources. The core issue lies in the server-side validation process, which accepts requests from users who do not possess the requisite administrative rights for specific endpoints or functions. This lack of strict role-based access control allows lower-privileged accounts to interact with protected API endpoints and database operations intended exclusively for high-level administrators.
The operational impact of this vulnerability is severe due to the sensitive nature of form submissions, which often contain personally identifiable information such as names, email addresses, phone numbers, and other private data. An attacker can read these confidential submissions, leading to a significant breach of user privacy and potential violation of data protection regulations like GDPR or CCPA. Furthermore, the ability to change submission statuses allows an adversary to manipulate workflow processes, potentially causing confusion in business operations or hiding malicious activities by altering records.
Beyond data exfiltration, the vulnerability permits authenticated users with Custom-level access to permanently delete form submissions. This capability poses a direct threat to data integrity and availability, as critical information can be irretrievably lost without authorization from system administrators. Such actions could disrupt record-keeping processes, hinder legal compliance efforts that require retention of certain records, and cause operational downtime while data is restored or investigated.
Additionally, the flaw extends to global plugin settings modification. An attacker with Custom-level access can alter configuration parameters that affect how the entire site handles forms, potentially disabling security features, changing notification routes, or modifying database connection strings if exposed through these settings. This level of control over core functionality undermines the integrity of the WordPress installation and could facilitate further exploitation vectors by weakening the overall security posture of the web application environment.
Mitigation strategies should prioritize immediate remediation by upgrading to a patched version of Fluent Forms that addresses this authorization bypass issue. Until an update is available, administrators can implement temporary workarounds such as restricting Custom-level user roles from accessing specific plugin menus or endpoints using additional access control plugins or custom code snippets that enforce stricter role checks at the application level. Regular auditing of user permissions and monitoring for unusual activity patterns related to form submissions and settings changes are also recommended to detect potential exploitation attempts early.