PT-2026-57057 · Wpmanageninja · Fluent Forms – Customizable Contact Forms

Fernando Mecozzi · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-5069

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-5069

Affected Products

Fluent Forms – Customizable Contact Forms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-5069 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3513845/fluentform · Note