# CVE-2026-11880: WPManageNinja Fluent Forms IDOR in subscription cancellation

Source: https://junglewise.ai/threats/cve-2026-11880-wpmanageninja-fluent-forms-idor-in-subscription-cancellation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-11880 · Severity: info · CVSS 4.3 · Published 2026-07-01

Fluent Forms is a popular WordPress plugin used to create forms and manage customer payments and subscriptions. A security flaw allows any logged-in user, such as a basic subscriber, to cancel the active subscriptions of other customers. This could lead to unexpected service disruptions for customers and loss of recurring revenue for the business.

Technologies: [WPManageNinja Fluent Forms](https://junglewise.ai/threats/technologies/fluent-forms). Vendors: [WPManageNinja](https://junglewise.ai/threats/vendors/wpmanageninja).

## Quick answers

**Is CVE-2026-11880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11880 being exploited in the wild.

**How severe is CVE-2026-11880?** Informational severity, with a CVSS score of 4.3, published 1 July 2026.

**Which products and versions are affected?** WPManageNinja Fluent Forms before 6.2.1.

**Is there a fix for CVE-2026-11880?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11880 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11880?** Check whether you run WPManageNinja Fluent Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Fluent Forms plugin due to insufficient authorization checks in the 'cancel_transaction' route of the 'fluentform_user_payment_endpoints' AJAX action. While the plugin requires a valid nonce, it fails to verify that the 'subscription_id' provided in the POST request belongs to the currently authenticated user. An attacker with a low-privilege Subscriber account and their own active subscription can obtain a valid nonce and then submit a request to cancel any other user's subscription by providing the victim's ID. This issue is fixed in version 6.2.1.

## Affected products

- WPManageNinja Fluent Forms before 6.2.1

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-07-01: other: NVD publication date

## References

- [https://wpscan.com/vulnerability/5de7c9e9-3a47-4bc6-a1b2-33eb8d3e3ec0/](https://wpscan.com/vulnerability/5de7c9e9-3a47-4bc6-a1b2-33eb8d3e3ec0/)

## Related threats

- [wpmanageninja Fluent Forms reflected XSS via param parameter](https://junglewise.ai/threats/cve-2026-17571-wpmanageninja-fluent-forms-reflected-xss-via-param-parameter)
- [WPManageNinja Fluent Forms IDOR in transaction parameter](https://junglewise.ai/threats/cve-2026-17567-wpmanageninja-fluent-forms-idor-in-transaction-parameter)
- [WPManageNinja Fluent Forms Stored XSS in Date/Time field configuration](https://junglewise.ai/threats/cve-2026-11881-wpmanageninja-fluent-forms-stored-xss-in-date-time-field)
- [Fluent Forms Stored XSS in Name Field Nested password Member](https://junglewise.ai/threats/cve-2026-16655-fluent-forms-stored-xss-in-name-field-nested-password-member)
- [WPManageNinja Fluent Forms incorrect authorization in payment cancellation](https://junglewise.ai/threats/cve-2026-5069-wpmanageninja-fluent-forms-incorrect-authorization-in-payment)