CVE-2024-2771: CWE-862 Missing Authorization in techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.
AI Analysis
Technical Summary
The Fluent Forms plugin for WordPress, used for creating customizable contact forms, surveys, quizzes, and conversational forms, contains a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to and including 5.1.16. This missing authorization allows unauthenticated attackers to escalate privileges by assigning Fluent Form management permissions to users or deleting existing manager accounts. The vulnerability is classified as CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An unauthenticated attacker can gain management permissions within the Fluent Forms plugin, granting access to all plugin settings and features. This includes the ability to delete manager accounts, effectively allowing full control over the plugin's administrative functions. Such control can compromise the integrity and availability of the plugin and potentially the broader WordPress site environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the available data, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the REST API endpoint if possible and consider disabling or limiting the use of the Fluent Forms plugin to trusted users only.
CVE-2024-2771: CWE-862 Missing Authorization in techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Description
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Fluent Forms plugin for WordPress, used for creating customizable contact forms, surveys, quizzes, and conversational forms, contains a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to and including 5.1.16. This missing authorization allows unauthenticated attackers to escalate privileges by assigning Fluent Form management permissions to users or deleting existing manager accounts. The vulnerability is classified as CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Potential Impact
An unauthenticated attacker can gain management permissions within the Fluent Forms plugin, granting access to all plugin settings and features. This includes the ability to delete manager accounts, effectively allowing full control over the plugin's administrative functions. Such control can compromise the integrity and availability of the plugin and potentially the broader WordPress site environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the available data, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the REST API endpoint if possible and consider disabling or limiting the use of the Fluent Forms plugin to trusted users only.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-03-21T15:41:42.767Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6db5b7ef31ef0b58b2e1
Added to database: 2/25/2026, 9:46:29 PM
Last enriched: 4/9/2026, 7:53:46 PM
Last updated: 4/12/2026, 1:09:10 AM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.