Junglewise Threat Intelligence

CVE-2026-5069: WPManageNinja Fluent Forms incorrect authorization in payment cancellation

CVE-2026-5069 · Severity: medium · CVSS 5.4 · Published 2026-07-10

Executive brief

Fluent Forms is a popular WordPress plugin used to create contact forms and manage payments. A security flaw allows any logged-in user, such as a basic subscriber, to cancel the paid subscriptions of other customers. This could lead to loss of revenue, disrupted services for legitimate users, and significant administrative overhead to restore cancelled accounts.

Technical details

The Fluent Forms plugin for WordPress suffers from an incorrect authorization vulnerability (CWE-863) within its payment cancellation AJAX flow. The root cause is a failure to perform sufficient ownership validation on the 'subscription_id' parameter. An authenticated attacker with minimal privileges (Subscriber-level and above) can send a crafted AJAX request to trigger the cancellation of any subscription ID. This vulnerability is exploitable over the network without user interaction. A fix was introduced in the plugin's changeset 3513845.

Affected products

  • WPManageNinja Fluent Forms up to and including 6.2.1

Timeline

  • 2026-07-10: advisory: NVD and Wordfence published the vulnerability details.
  • 2026-07-10: disclosed

References

Related threats