{"id":"CVE-2026-120858","kind":"vulnerability","aliases":["CVE-2026-120858"],"related":[],"title":"FluentForm WordPress plugin: missing authorization check exposes form access","description":"Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16.","summary":"FluentForm, a WordPress form builder plugin by WP ManageNinja LLC, has a missing authorization check in versions through 6.2.16. An attacker can reach functions they should not be allowed to use because access control is not enforced.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluentform","package","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed FluentForm version in the WordPress admin plugin list or with `wp plugin get fluentform --field=version`\n- Compare the result against `6.2.16`; versions at or below it are in the stated range","fix":"- FluentForm: a fixed version is not stated in the sources; unknown","status":"open","published_at":"2026-11-08T16:16:37+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","triaged_at":"2026-11-08T16:18:54+00:00","updated_at":"2026-11-08T16:18:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-08T16:18:54Z","model":"claude-haiku-5-5","output":{"fix":"- FluentForm: a fixed version is not stated in the sources; unknown","reach":"unknown","title":"FluentForm WordPress plugin: missing authorization check exposes form access","impact":"medium","summary":"FluentForm, a WordPress form builder plugin by WP ManageNinja LLC, has a missing authorization check in versions through 6.2.16. An attacker can reach functions they should not be allowed to use because access control is not enforced.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fluentform"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions; exact impact not stated","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and the exact unauthorized action.","how_to_check":"- Check the installed FluentForm version in the WordPress admin plugin list or with `wp plugin get fluentform --field=version`\n- Compare the result against `6.2.16`; versions at or below it are in the stated range","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the FluentForm WordPress plugin at version 6.2.16 or earlier are in the stated range. The sources do not say which configurations or roles are needed to reach the missing check, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4545,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120858':12A,15A '-2026':11A,14A '6.2.16':37B,79C 'access':9A,51B,69C 'affect':74C 'allow':47B,65C 'attack':39B 'author':5A,32B,57C 'builder':23B 'check':6A,33B 'configur':68C 'control':52B,70C 'cve':10A,13A 'enforc':55B 'exploit':66C 'expos':7A 'fluentform':1A,16B,19B,63C,64C,75C 'form':8A,22B 'function':42B 'incorrect':67C 'issu':73C 'levels.this':72C 'llc':28B,62C 'manageninja':27B,61C 'miss':4A,31B,56C 'n/a':77C 'packag':17B 'plugin':3A,24B 'reach':41B 'secur':71C 'use':49B 'version':35B 'vulner':58C 'wordpress':2A,18B,21B 'wp':26B,60C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FluentForm WordPress plugin at version 6.2.16 or earlier are in the stated range. The sources do not say which configurations or roles are needed to reach the missing check, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fluentform","medium","package","wordpress"],"campaign_type":null,"search_a":"'-120858':12A,15A '-2026':11A,14A 'access':9A 'author':5A 'check':6A 'cve':10A,13A 'expos':7A 'fluentform':1A 'form':8A 'miss':4A 'plugin':3A 'wordpress':2A","search_b":"'6.2.16':37B 'access':51B 'allow':47B 'attack':39B 'author':32B 'builder':23B 'check':33B 'control':52B 'enforc':55B 'fluentform':16B,19B 'form':22B 'function':42B 'llc':28B 'manageninja':27B 'miss':31B 'packag':17B 'plugin':24B 'reach':41B 'use':49B 'version':35B 'wordpress':18B,21B 'wp':26B","search_c":"'6.2.16':79C 'access':69C 'affect':74C 'allow':65C 'author':57C 'configur':68C 'control':70C 'exploit':66C 'fluentform':63C,64C,75C 'incorrect':67C 'issu':73C 'levels.this':72C 'llc':62C 'manageninja':61C 'miss':56C 'n/a':77C 'secur':71C 'vulner':58C 'wp':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120858","severity":null,"published_at":"2026-11-08T16:16:37+00:00","modified_at":"2026-11-08T16:16:37+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","fetched_at":"2026-11-08T16:18:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}