Fluent Forms CVE-2026-5396: Authorization Bypass Threatens WordPress Submissions

The Fluent Forms plugin for WordPress, in all versions up to and including 6.1.21, is vulnerable to an Authorization Bypass Through User-Controlled Key, identified as CVE-2026-5396. The National Vulnerability Database reports this flaw stems from the SubmissionPolicy class, which mishandles submission-level actions like reading, modifying, or deleting entries. Authorization is based on a user-supplied form_id query parameter, which is easily spoofed.

This vulnerability allows authenticated attackers, even those with limited Fluent Forms Manager access restricted to specific forms, to bypass intended controls. By manipulating the form_id parameter to reference a form they are authorized for, they can then access, modify, add notes to, or permanently delete submissions from any other form on the WordPress site. The National Vulnerability Database assigns a CVSS score of 8.2 (HIGH).

For defenders, this means a serious integrity and confidentiality risk to form data. Any organization using Fluent Forms for critical data collection, customer interactions, or internal processes must recognize that even their ‘restricted’ managers could be leveraged by an attacker to compromise sensitive information. The attacker’s calculus here is straightforward: exploit an authorization flaw to elevate privileges laterally and gain access to a broader dataset than initially permitted.