The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in all versions up to and including 6.1.7. Specifically, the AJAX action 'fluentform_ai_create_form' lacks proper capability checks, enabling authenticated users with minimal privileges (Subscriber-level and above) to create arbitrary forms through the publicly exposed AI builder interface. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with low complexity and no user interaction required, but limited impact to integrity only.

An attacker with at least Subscriber-level access can create arbitrary forms on the affected WordPress site without proper authorization. This could lead to unauthorized content injection or manipulation within the forms, potentially impacting the integrity of the site’s data or user interactions. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, site administrators should monitor the vendor’s announcements for updates. Until a fix is available, restrict user roles to trusted users only and consider disabling the AI builder feature if possible to limit exposure.