The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the /wp-json/fluentform/v1/global-settings REST API endpoint. This allows unauthenticated attackers to modify all plugin settings due to the absence of a capability check. The vulnerability affects all versions up to and including 5.1.16 and has a CVSS 3.1 base score of 7.5, reflecting high impact on integrity with network attack vector and no required privileges or user interaction.

An attacker can modify all settings of the Fluent Forms plugin without authentication, potentially altering form behavior, data handling, or other configurations. This compromises the integrity of the plugin's settings but does not directly expose confidential data or cause denial of service. The vulnerability could be leveraged to disrupt form operations or inject malicious configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress REST API endpoints where possible and monitor for unusual changes in plugin settings. Avoid exposing the vulnerable endpoint publicly if feasible.