CVE-2026-5069
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Fluent Forms plugin for WordPress up to version 6.2.1 contains an incorrect authorization vulnerability in the 'subscription_id' parameter. Insufficient ownership checks in the AJAX payment cancellation flow allow authenticated attackers with subscriber-level access or higher to cancel other users' subscriptions.
Risk Assessment
The organization is at risk of unauthorized subscription cancellations by unprivileged users, potentially leading to revenue loss, service disruption, and customer trust erosion.
Recommendation
Immediately update the Fluent Forms plugin to the latest available version that fixes this vulnerability. Until the update is applied, restrict access to the payment cancellation functionality to trusted users only.
Other vulnerabilities in Fluent Forms
See all- CVE-2026-18146High
The Fluent Forms plugin for WordPress (versions up to 6.2.11) is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values. Unauthenticated attackers can inject arbitrary web scripts that execute in the browser of an administrator when viewing submission logs. Exploitation requires configured email notifications with attacker-influenced Smartcode values.
- CVE-2026-17571Medium
The Fluent Forms plugin for WordPress up to version 6.2.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability via the 'param' parameter. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.
- CVE-2026-17567Medium
The Fluent Forms plugin for WordPress up to version 6.2.8 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'transaction' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email, billing address, order items, payment method, and payment status of other users.
- CVE-2026-11881Medium
The Fluent Forms WordPress plugin before 6.2.6 does not sanitize and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered. Users with a role as low as Contributor (with delegated form-management permission, but lacking unfiltered_html, e.g., in a multisite setup) can perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.
- CVE-2026-16655High
The Fluent Forms plugin for WordPress up to version 6.2.7 has a Stored XSS vulnerability via the Name field nested in `password`. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user views the page.
- CVE-2026-11578Low
The Fluent Forms WordPress plugin before version 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage. This allows a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms.
- CVE-2026-11880Low
The Fluent Forms WordPress plugin before version 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with low privileges to cancel subscriptions belonging to other users.
Original NVD description (English source)
The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.