CVE-2026-120858 · Package
NO FIX YET · SEE WHAT TO DO
FluentForm, a WordPress form builder plugin by WP ManageNinja LLC, has a missing authorization check in versions through 6.2.16. An attacker can reach functions they should not be allowed to use because access control is not enforced.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the FluentForm WordPress plugin at version 6.2.16 or earlier are in the stated range. The sources do not say which configurations or roles are needed to reach the missing check, so unknown.
Who cares fluentform, wordpress
wp plugin get fluentform --field=version6.2.16; versions at or below it are in the stated rangeMissing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.