WordPress Fluent Forms IDOR Exposes Sensitive Data, Bypasses Access Controls

/HIGH /CVSS 8.2/10
Written by SCW Vulnerability Desk Vulnerability Intelligence
SCW vulnerabilitycvehigh-severitycwe-639
WordPress Fluent Forms IDOR Exposes Sensitive Data, Bypasses Access Controls

The National Vulnerability Database has detailed CVE-2026-5395, a high-severity Insecure Direct Object Reference (IDOR) flaw in the Fluent Forms WordPress plugin, versions up to and including 6.2.0. This vulnerability resides within the exportEntries function, stemming from a critical lack of validation on user-controlled input. This isn’t just a minor bug; it’s a direct path to serious data exposure.

Authenticated attackers with Fluent Forms manager-level access, or higher, can exploit this IDOR to bypass intended form-level access restrictions. This means they can view submissions from forms they are explicitly not authorized to see. Worse, the flaw allows for the export of data from arbitrary database tables and, through error message disclosure, even the enumeration of database table names. The CVSS score of 8.2 (HIGH) underscores the significant impact on confidentiality and the ease of exploitation.

This isn’t just about a single plugin; it highlights a pervasive issue in web application security. The attacker’s calculus here is simple: leverage a legitimate, privileged account to access data far beyond its intended scope. For defenders, this means a compromised manager account is no longer just a risk to its assigned forms, but potentially to the entire database. It’s a classic privilege escalation through an insecure direct object reference, a common vulnerability type (CWE-639) that continues to plague applications.

What This Means For You

  • If your organization uses the Fluent Forms plugin for WordPress, you need to assess your risk immediately. This vulnerability allows authenticated users with manager-level access to exfiltrate sensitive data from forms they shouldn't see, and potentially other database tables. Patch to a version beyond 6.2.0 as soon as an update is available, and scrutinize logs for any unusual data export activities from Fluent Forms accounts.

Related ATT&CK Techniques

T1190 Exploit Public-Facing Application Initial Access T1078.004 Abuse Elevation Control Mechanism: Sudo and Sudo Caching Privilege Escalation T1219 Remote Access Software Persistence

🛡️ Detection Rules

3 rules · 6 SIEM formats

3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.

high T1190 Initial Access

WordPress Fluent Forms exportEntries IDOR - CVE-2026-5395

Sigma YAML — free preview 
title: WordPress Fluent Forms exportEntries IDOR - CVE-2026-5395
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-5395 by targeting the exportEntries function in WordPress Fluent Forms. This rule looks for specific parameters in the request URI that are indicative of the IDOR vulnerability, allowing unauthorized access to form submissions.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-5395/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=fluent_forms_export_entries'
      cs-uri-query|contains:
          - 'form_id='
      cs-uri-query|contains:
          - 'user_id='
      cs-uri-query|contains:
          - 'entry_id='
      cs-uri-query|contains:
          - 'file_format='
      cs-uri-query|contains:
          - 'nonce='
      cs-uri-query|contains:
          - 'data_key='
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse

✓ Sigma · Splunk SPL Sentinel KQL Elastic QRadar AQL Wazuh Get rules for your SIEM →

Indicators of Compromise

IDTypeIndicator
CVE-2026-5395 IDOR Fluent Forms plugin for WordPress versions <= 6.2.0
CVE-2026-5395 IDOR Vulnerable function: exportEntries
CVE-2026-5395 Information Disclosure Export data from arbitrary database tables
CVE-2026-5395 Information Disclosure Enumerate database table names via error message disclosure

Written by SCW Vulnerability Desk

Source & Attribution
Source PlatformNVD
ChannelNational Vulnerability Database
PublishedMay 14, 2026 at 10:16 UTC

This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.

Believe this infringes your rights? Submit a takedown request.

Related coverage

CVE-2026-6670 — Path Traversal

CVE-2026-6670 — The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub_dir' and...

vulnerabilityCVEmedium-severitypath-traversalcwe-22
/SCW Vulnerability Desk /MEDIUM /6.5 /⚑ 2 IOCs /⚙ 3 Sigma

CVE-2026-6510: Critical Privilege Escalation in InfusedWoo Pro WordPress Plugin

CVE-2026-6510 — The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This...

vulnerabilityCVEcriticalhigh-severityprivilege-escalationcwe-862
/SCW Vulnerability Desk /CRITICAL /9.8 /⚑ 4 IOCs /⚙ 2 Sigma

InfusedWoo Pro Plugin Privilege Escalation (CVE-2026-6506)

CVE-2026-6506 — The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to...

vulnerabilityCVEhigh-severityprivilege-escalationcwe-862
/SCW Vulnerability Desk /HIGH /8.8 /⚑ 5 IOCs