PT-2026-23130 · WordPress · Fluent Forms Pro Add On Pack+1

Prickly Cactus · Publicado 2026-03-05 · Atualizado 2026-03-08 · CVE-2026-2899

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions up to and including 6.1.17

Description The Fluent Forms Pro Add On Pack plugin for WordPress has a missing authorization issue. The deleteFile() method within the Uploader class does not properly verify nonces or check user capabilities. An AJAX action is publicly registered, creating both wp ajax and wp ajax nopriv hooks. This allows unauthenticated attackers to delete arbitrary WordPress media attachments by manipulating the attachment id parameter. The vulnerability is exploitable through the attachment id parameter, not the path parameter as initially reported.

Recommendations Update Fluent Forms Pro Add On Pack to a version later than 6.1.17.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2899

Produtos afetados

Fluent Forms Pro Add On Pack

Wordpress

Referências · 7

• https://fluentforms.com/docs/changelog/#3-toc-title · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835d-038b765c68a6?source=cve · Nota
• https://twitter.com/CVEnew/status/2030755413918941592 · Publicação no Twitter
• https://t.me/cveNotify/154266 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2899 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2029424845532921871 · Publicação no Twitter
• https://t.me/CVEtracker/46406 · Publicação no Telegram