VulnSocial

CVE-2026-5396Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21. This is due to the SubmissionPolicy class authorizing submission-level actions (read, modify, delete, add notes) based on a user-supplied `form_id` query parameter. This makes it possible for authenticated attackers, with Fluent Forms Manager access restricted to specific forms, to read, modify status, add notes to, and permanently delete form submissions belonging to any other form by spoofing the form_id parameter to a form they are authorized for.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-14: 2Technical Details · 2026-05-14: 205-14
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-5396 The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions… CVSS 8.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-5396 #WordPress #CyberSecurity #InfoSec

    Post summary

    This post announces a high‑severity authorization bypass flaw (CVE‑2026‑5396) in the Fluent Forms WordPress plugin, including a link to a detailed analysis but no PoC or exploit code.

    0001037
    90 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-5396 Authorization Bypass in Fluent Forms Plugin for WordPress Up to 6.1.21 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5396

    Post summary

    A new vulnerability (CVE-2026-5396) involving an authorization bypass in the Fluent Forms WordPress plugin (up to v6.1.21) has been disclosed, but no PoC, exploit, patch, or evidence of active exploitation is provided.

    0000054
    4.0K followersView on X

Explore more

Back to dashboard