CVE-2026-5396 affects the Fluent Forms plugin for WordPress, where the SubmissionPolicy class authorizes submission-level actions based on a user-supplied form_id query parameter. This allows authenticated attackers with restricted Fluent Forms Manager access to bypass authorization controls by spoofing the form_id parameter. Consequently, they can perform unauthorized read, modify, note addition, and deletion operations on submissions belonging to other forms. The vulnerability impacts all versions up to and including 6.1.21. The CVSS 3.1 base score is 8.2, indicating high severity. No patch or official remediation level has been published, and the plugin is not a cloud service, so remediation depends on vendor updates.

Exploiting this vulnerability enables attackers with some level of authenticated access to bypass authorization restrictions and manipulate form submissions across different forms. This can lead to unauthorized disclosure of submission data, unauthorized modification of submission status, addition of misleading notes, and permanent deletion of submissions. The impact on confidentiality is high, integrity impact is low, and availability is not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Fluent Forms Manager access strictly and monitor for suspicious activity related to form submissions. Avoid granting broad form management permissions to users. Follow vendor communications for updates on patches or official mitigations.