CVE-2026-5069 describes an incorrect authorization vulnerability (CWE-863) in the Fluent Forms WordPress plugin by wpmanageninja. The flaw exists in the payment cancellation AJAX endpoint where the 'subscription_id' parameter is not properly verified for ownership. As a result, authenticated users with subscriber-level privileges or above can submit cancellation requests affecting subscriptions they do not own. This could lead to unauthorized subscription cancellations. The vulnerability affects versions up to and including 6.2.1. No official patch or remediation level has been provided as of the publication date.

The vulnerability allows authenticated users with subscriber-level or higher privileges to cancel subscriptions belonging to other users without proper authorization. This can disrupt subscription services and cause denial of service to legitimate subscribers. There is no indication of confidentiality or data disclosure impact, but integrity and availability of subscription management are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious subscription cancellation activity. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official patch or temporary mitigation.