CVE-2026-5069 describes an incorrect authorization vulnerability (CWE-863) in the Fluent Forms plugin for WordPress, versions up to and including 6.2.1. The issue arises from insufficient ownership authorization checks in the AJAX payment cancellation process, allowing authenticated users with subscriber-level privileges or above to submit cancellation requests for subscriptions they do not own. This flaw enables unauthorized modification of subscription states, potentially disrupting service for other users.

Exploitation allows authenticated users with subscriber-level access or higher to cancel subscriptions belonging to other users. This impacts the integrity and availability of subscription data but does not disclose confidential information. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level permissions where possible and monitor for suspicious cancellation activity. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official patch or temporary mitigation.