CVE-2026-15178: CWE-862 Missing Authorization in wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

CVE-2026-15178 is an authorization bypass vulnerability (CWE-862) in the Fluent Forms plugin for WordPress, affecting all versions up to and including 6.2.5. The plugin fails to properly verify that users are authorized to perform certain actions. As a result, authenticated users with Custom-level access or above can read private form submissions, alter submission statuses, delete submissions permanently, and modify global plugin settings. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Authenticated users with Custom-level access or higher can bypass authorization controls to access and manipulate private form submissions and global plugin settings. This could lead to unauthorized data disclosure, data modification, and deletion within the plugin's scope. The impact is limited to users who already have some level of authenticated access but not necessarily administrative privileges.

No explicit patch or remediation link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to minimize exposure, and monitor for updates from the vendor regarding patches or official fixes.