CVE-2026-5069 | The Fluent Forms plugin for WordPress is vulnerable to incor… | CVSS 5.4 MEDIUM

Description

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

Metadata

CVE ID: CVE-2026-5069
State: PUBLISHED
Assigner: Wordfence
Reserved: 2026-03-27 22:53 UTC
Published: 2026-07-10 02:30 UTC
Last updated: 2026-07-10 02:30 UTC
Primary CWE: CWE-863
CWE-863 Incorrect Authorization
Vendor / Product: wpmanageninja / Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Sources: cve.org · NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products (1)

Vendor	Product	Platform	Versions
wpmanageninja	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder	—	0 ≤ 6.2.1

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	CWE-863 Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.4	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References (2)