CVE-2026-11578 is an authorization bypass vulnerability (CWE-639) in the Fluent Forms WordPress plugin prior to version 6.2.5. The plugin fails to properly restrict deletion of form submission entries to only those forms a restricted Manager user is authorized to manage. Consequently, a Manager limited to specific forms can delete submission entries belonging to other forms. This vulnerability requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms. No CVSS score or patch information is currently available.

An attacker with Manager-level access restricted to certain forms can delete submission entries from forms outside their authorization scope. This could lead to unauthorized data loss or manipulation of form submission records. The impact is limited to users with Manager privileges and a specific non-default configuration, but it undermines the intended access controls within the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review Manager role configurations and consider limiting Manager privileges or avoiding form-specific restrictions that could be exploited. Monitor vendor communications for updates and apply official patches once released.