CVE-2026-5069: falha de média gravidade em wpmanageninja Fluent Forms – Customizable…
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
Publicada em
Seguir esta CVE+ Monitorar Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
wpmanageninja · Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form BuilderCVEs relacionadas — wpmanageninja Fluent Forms – Customizable…
No mesmo produto, das mais perigosas para as menos.
CVE-2026-17567MEDIUMFluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' ParameterEPSS 0.6%CVE-2026-16655HIGHFluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` MemberEPSS 0.5%CVE-2026-18146HIGHFluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode ValuesEPSS 0.5%CVE-2026-17571MEDIUMFluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'EPSS 0.4%CVE-2026-101324MEDIUMFluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode ParameterEPSS 0.2%CVE-2026-15178MEDIUMFluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and ModificationEPSS 0.2%