---
id: "CVE-2026-120522"
page: "https://infrastack.ai/live/CVE-2026-120522"
kind: "vulnerability"
aliases: ["CVE-2026-120522"]
title: "WordPress Fluent Forms cloud storage plugin: unauthenticated arbitrary file write"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Cloud Storage Manager for Fluent Forms", "fixed": ["1.2.5"], "affected": "<= 1.2.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fluent-forms", "google-drive", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-14T13:17:20+00:00"
first_seen_at: "2026-11-14T13:28:09+00:00"
updated_at: "2026-11-14T13:30:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120522", "first_seen_at": "2026-11-14T13:28:09+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal", "first_seen_at": "2026-11-14T13:30:38+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal", "https://docs.fluentwiz.com/cloud-storage-manager/support/changelog"]}]
exploit_sources: []
---

# WordPress Fluent Forms cloud storage plugin: unauthenticated arbitrary file write

Link for people: https://infrastack.ai/live/CVE-2026-120522 (this .md is for agents)

The Cloud Storage Manager for Fluent Forms WordPress plugin, up to and including 1.2.0, has REST endpoints with missing authorization checks and path handling that lets an unauthenticated attacker write files outside the intended downloads directory. If a PHP file lands in a web-accessible location, the attacker can run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cloud Storage Manager for Fluent Forms affected <= 1.2.0 fixed 1.2.5

## How to check

- WordPress admin > Plugins: find 'Cloud Storage Manager for Fluent Forms' (slug cloud-storage-manager); version 1.2.0 or lower is affected, 1.2.5 is the patched version per Wordfence.
- With WP-CLI: wp plugin get cloud-storage-manager --field=version
- Search request logs for unauthenticated calls to REST routes connection/{driver}/save and /download/single-file, and look for unexpected .php files outside the plugin's downloads directory.
- Check the plugin's Google Drive connection still uses your own account; an unknown account means credentials were replaced.

## Fix

Update Cloud Storage Manager for Fluent Forms (slug cloud-storage-manager) to 1.2.5 or newer (per Wordfence). If you cannot update, deactivate the plugin, or block external access to its REST routes connection/*/save and download/single-file.

## Timeline

- 2026-11-14T13:28:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120522
- 2026-11-14T13:30:38+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal — Wordfence (CNA) advisory: affected <=1.2.0, patched 1.2.5. Vendor changelog lists 1.2.5 without naming the security fix and oddly marks 1.3.0 as current, so nothing marked verified. No exploitation or PoC seen; no posts searched.

## Documents

- [advisory] Wordfence: Cloud Storage Manager for Fluent Forms <= 1.2.0 arbitrary file write https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cloud-storage-manager/cloud-storage-manager-for-fluent-forms-120-unauthenticated-arbitrary-file-write-via-google-drive-filename-path-traversal
- [fix] FluentWiz Cloud Storage Manager changelog https://docs.fluentwiz.com/cloud-storage-manager/support/changelog

## From the sources

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the `connection/{driver}/save` and `/download/single-file` REST endpoints, combined with insufficient path validation in the Google Drive `downloadFile()` function, where the Google Drive metadata `name` value is concatenated into a local path without `basename()`, `sanitize_file_name()`, or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended `downloads` directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_