CVE-2026-81297
HighCVSS 7.5Summary
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.
Risk Assessment
A subscriber user may gain unauthorized privileges, potentially leading to unauthorized actions in the system.
Recommendation
Update Fluent Forms Pro Add On Pack to a patched version.
Other vulnerabilities in Fluent Forms Pro Add On Pack
See all- CVE-2026-81296High
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.
- CVE-2026-66633High
Unauthenticated XSS vulnerability in Fluent Forms Pro Add On Pack versions prior to 6.2.12. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-15962High
The Fluent Forms Pro Add On Pack plugin for WordPress up to version 6.2.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Subscriber-level access or above can inject a PHP Object. The presence of a POP chain allows changing user passwords and potentially taking over administrator accounts. Exploitation is only possible if user update integration is enabled and a user meta field is mapped.
Original NVD description (English source)
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.