CVE-2026-81296
HighCVSS 7.5Summary
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.
Risk Assessment
An unauthenticated person may gain access to functions or data they should not have access to.
Recommendation
Update Fluent Forms Pro Add On Pack to the latest patched version.
Other vulnerabilities in Fluent Forms Pro Add On Pack
See all- CVE-2026-81297High
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.
- CVE-2026-66633High
Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-15962High
The Fluent Forms Pro Add On Pack plugin for WordPress up to version 6.2.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Subscriber-level access or above can inject a PHP Object. The presence of a POP chain allows changing user passwords and potentially taking over administrator accounts. Exploitation is only possible if user update integration is enabled and a user meta field is mapped.
Original NVD description (English source)
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.