PT-2026-40870 · WordPress · Fluent Forms

Sander Horsman · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-5396

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fluent Forms versions prior to 6.1.22

Description An authorization bypass exists in the SubmissionPolicy class, which authorizes submission-level actions such as reading, modifying, deleting, and adding notes based on a user-supplied form id query parameter. Authenticated attackers with Fluent Forms Manager access restricted to specific forms can spoof the form id parameter to access, modify the status of, add notes to, or permanently delete form submissions belonging to any other form.

Recommendations Update to version 6.1.22 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5396

Affected Products

Fluent Forms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5396 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/81aad41e-0330-4dff-a5f8-08a108d724f5?source=cve · Note
• https://t.me/CVEtracker/53741 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2054811467128430780 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=/fluentform/tags/6.1.21/app/Http/Policies/SubmissionPolicy.php&new_path=/fluentform/tags/6.2.0/app/Http/Policies/SubmissionPolicy.php · Note
• https://twitter.com/VulmonFeeds/status/2054939655863234857 · Twitter Post