{"id":"CVE-2026-120522","kind":"vulnerability","aliases":["CVE-2026-120522"],"related":[],"title":"WordPress Fluent Forms cloud storage plugin: unauthenticated arbitrary file write","description":"The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the `connection/{driver}/save` and `/download/single-file` REST endpoints, combined with insufficient path validation in the Google Drive `downloadFile()` function, where the Google Drive metadata `name` value is concatenated into a local path without `basename()`, `sanitize_file_name()`, or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended `downloads` directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.","summary":"The Cloud Storage Manager for Fluent Forms WordPress plugin, up to and including 1.2.0, has REST endpoints with missing authorization checks and path handling that lets an unauthenticated attacker write files outside the intended downloads directory. If a PHP file lands in a web-accessible location, the attacker can run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cloud Storage Manager for Fluent Forms","fixed":["1.2.5"],"affected":"<= 1.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fluent-forms","google-drive","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: find 'Cloud Storage Manager for Fluent Forms' (slug cloud-storage-manager); version 1.2.0 or lower is affected, 1.2.5 is the patched version per Wordfence.\n- With WP-CLI: wp plugin get cloud-storage-manager --field=version\n- Search request logs for unauthenticated calls to REST routes connection/{driver}/save and /download/single-file, and look for unexpected .php files outside the plugin's downloads directory.\n- Check the plugin's Google Drive connection still uses your own account; an unknown account means credentials were replaced.","fix":"Update Cloud Storage Manager for Fluent Forms (slug cloud-storage-manager) to 1.2.5 or newer (per Wordfence). If you cannot update, deactivate the plugin, or block external access to its REST routes connection/*/save and download/single-file.","status":"open","published_at":"2026-11-14T13:17:20+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","triaged_at":"2026-11-14T13:28:57+00:00","updated_at":"2026-11-14T13:30:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-14T13:28:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Fluent Forms cloud storage plugin: unauthenticated arbitrary file write","impact":"high","summary":"The Cloud Storage Manager for Fluent Forms WordPress plugin, up to and including 1.2.0, has REST endpoints with missing authorization checks and path handling that lets an unauthenticated attacker write files outside the intended downloads directory. If a PHP file lands in a web-accessible location, the attacker can run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fluent-forms","google-drive"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker writes files, possibly PHP code, on the server","analyst_note":"Confirm the fixed version and whether a patched release exists; the sources give only 'up to and including 1.2.0'.","how_to_check":"- Check whether the plugin `Cloud Storage Manager for Fluent Forms` is installed and its version is `1.2.0` or lower.\n- Look for the REST routes `connection/{driver}/save` and `/download/single-file` in the site's plugin code or request logs.\n- unknown for further checks","plain_action":"","product_name":"Cloud Storage Manager for Fluent Forms","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Cloud Storage Manager for Fluent Forms plugin at version 1.2.0 or earlier, where its Google Drive download feature is used. The sources do not say whether sites without the Google Drive connection are exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000795,"input_tokens":4795,"output_tokens":632,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patched release exists; the sources give only 'up to and including 1.2.0'.","search":"'-120522':13A,16A '-2026':12A,15A '/download/single-file':132C '/save':130C '1.2.0':47B,118C 'access':79B,225C 'arbitrari':8A,108C 'attack':62B,82B,174C,178C,189C,203C 'attacker-control':177C,202C 'attacker-own':188C 'author':53B,124C 'basenam':160C 'canon':165C 'check':54B,125C 'cloud':4A,17A,35B,90C 'code':85B,232C 'combin':135C 'concaten':154C 'connect':128C 'contain':197C 'content':205C 'control':179C,204C 'credenti':182C 'cve':11A,14A 'directori':69B,210C 'download':68B,185C,209C 'downloadfil':144C 'drive':28B,97C,143C,149C,181C 'driver':129C 'dropbox':98C 'due':121C 'endpoint':50B,134C 'execut':233C 'extens':218C 'file':9A,64B,73B,109C,162C,191C,214C 'filenam':196C 'fluent':2A,21A,24B,39B,94C 'fluent-form':23B 'for':20A 'form':3A,25B,40B,95C 'forms':22A 'function':145C 'googl':27B,96C,142C,148C,180C 'google-dr':26B 'handl':57B 'includ':46B,117C 'insuffici':137C 'intend':67B,208C 'land':74B,220C 'lead':229C 'let':59B 'local':157C 'locat':80B,226C 'make':169C 'manag':37B,92C 'manager':19A 'metadata':150C 'miss':52B,123C 'name':151C,163C 'onedr':99C 'outsid':65B,206C 'own':190C 'packag':29B 'path':56B,138C,158C,166C,198C 'php':72B,217C 'plugin':6A,33B,42B,102C 'possibl':171C 'provid':194C 'provider-return':193C 'remot':231C 'rest':49B,133C 'return':195C 'run':84B 's3':100C 'sanit':161C 'server':88B 'storag':5A,36B,91C 'storage':18A 'store':176C 'travers':199C 'trigger':183C 'unauthent':7A,61B,173C 'upload':101C 'valid':139C,167C 'valu':152C 'version':113C 'vulner':106C 'web':78B,224C 'web-access':77B,223C 'whose':192C 'without':159C 'wordpress':1A,30B,32B,41B,104C 'wordpress-plugin':31B 'write':10A,63B,110C,201C 'written':213C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cloud Storage Manager for Fluent Forms plugin at version 1.2.0 or earlier, where its Google Drive download feature is used. The sources do not say whether sites without the Google Drive connection are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloudstoragemanagerforfluentforms","storagemanagerforfluentforms"],"ptokens":["cloud","fluent","for","forms","manager","storage"],"labels":["critical","fluentforms","googledrive","package","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-120522':13A,16A '-2026':12A,15A 'arbitrari':8A 'cloud':4A,17A 'cve':11A,14A 'file':9A 'fluent':2A,21A 'for':20A 'form':3A 'forms':22A 'manager':19A 'plugin':6A 'storag':5A 'storage':18A 'unauthent':7A 'wordpress':1A 'write':10A","search_b":"'1.2.0':47B 'access':79B 'attack':62B,82B 'author':53B 'check':54B 'cloud':35B 'code':85B 'directori':69B 'download':68B 'drive':28B 'endpoint':50B 'file':64B,73B 'fluent':24B,39B 'fluent-form':23B 'form':25B,40B 'googl':27B 'google-dr':26B 'handl':57B 'includ':46B 'intend':67B 'land':74B 'let':59B 'locat':80B 'manag':37B 'miss':52B 'outsid':65B 'packag':29B 'path':56B 'php':72B 'plugin':33B,42B 'rest':49B 'run':84B 'server':88B 'storag':36B 'unauthent':61B 'web':78B 'web-access':77B 'wordpress':30B,32B,41B 'wordpress-plugin':31B 'write':63B","search_c":"'/download/single-file':132C '/save':130C '1.2.0':118C 'access':225C 'arbitrari':108C 'attack':174C,178C,189C,203C 'attacker-control':177C,202C 'attacker-own':188C 'author':124C 'basenam':160C 'canon':165C 'check':125C 'cloud':90C 'code':232C 'combin':135C 'concaten':154C 'connect':128C 'contain':197C 'content':205C 'control':179C,204C 'credenti':182C 'directori':210C 'download':185C,209C 'downloadfil':144C 'drive':97C,143C,149C,181C 'driver':129C 'dropbox':98C 'due':121C 'endpoint':134C 'execut':233C 'extens':218C 'file':109C,162C,191C,214C 'filenam':196C 'fluent':94C 'form':95C 'function':145C 'googl':96C,142C,148C,180C 'includ':117C 'insuffici':137C 'intend':208C 'land':220C 'lead':229C 'local':157C 'locat':226C 'make':169C 'manag':92C 'metadata':150C 'miss':123C 'name':151C,163C 'onedr':99C 'outsid':206C 'own':190C 'path':138C,158C,166C,198C 'php':217C 'plugin':102C 'possibl':171C 'provid':194C 'provider-return':193C 'remot':231C 'rest':133C 'return':195C 's3':100C 'sanit':161C 'storag':91C 'store':176C 'travers':199C 'trigger':183C 'unauthent':173C 'upload':101C 'valid':139C,167C 'valu':152C 'version':113C 'vulner':106C 'web':224C 'web-access':223C 'whose':192C 'without':159C 'wordpress':104C 'write':110C,201C 'written':213C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120522","severity":null,"published_at":"2026-11-14T13:17:20+00:00","modified_at":"2026-11-14T13:17:20+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","fetched_at":"2026-11-14T13:28:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120522:3982","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal","severity":null,"published_at":"2026-11-14T13:30:38+00:00","modified_at":"2026-11-14T13:30:38+00:00","first_seen_at":"2026-11-14T13:30:38+00:00","fetched_at":"2026-11-14T13:30:38+00:00","note":"Wordfence (CNA) advisory: affected <=1.2.0, patched 1.2.5. Vendor changelog lists 1.2.5 without naming the security fix and oddly marks 1.3.0 as current, so nothing marked verified. No exploitation or PoC seen; no posts searched.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal","https://docs.fluentwiz.com/cloud-storage-manager/support/changelog"]}],"documents":[{"id":155859,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal","title":"Wordfence: Cloud Storage Manager for Fluent Forms <= 1.2.0 arbitrary file write","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":155860,"url":"https://docs.fluentwiz.com/cloud-storage-manager/support/changelog","title":"FluentWiz Cloud Storage Manager changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}