Executive brief
Fluent Forms is a popular WordPress plugin used to create contact forms and manage payments. A security flaw allows any logged-in user, such as a basic subscriber, to cancel the paid subscriptions of other customers. This could lead to loss of revenue, disrupted services for legitimate users, and significant administrative overhead to restore cancelled accounts.
Technical details
The Fluent Forms plugin for WordPress suffers from an incorrect authorization vulnerability (CWE-863) within its payment cancellation AJAX flow. The root cause is a failure to perform sufficient ownership validation on the 'subscription_id' parameter. An authenticated attacker with minimal privileges (Subscriber-level and above) can send a crafted AJAX request to trigger the cancellation of any subscription ID. This vulnerability is exploitable over the network without user interaction. A fix was introduced in the plugin's changeset 3513845.
Affected products
- WPManageNinja Fluent Forms up to and including 6.2.1
Timeline
- 2026-07-10: advisory: NVD and Wordfence published the vulnerability details.
- 2026-07-10: disclosed