The Fluent Forms plugin for WordPress suffers from an arbitrary file read vulnerability due to improper pathname limitation (CWE-22) in the getAttachments() method of EmailNotificationActions. The method attempts to validate file-upload URLs with a strpos() prefix check and wp_normalize_path(), but these checks can be bypassed using directory traversal sequences (e.g., '../../'). As a result, authenticated attackers with administrator privileges can supply crafted URLs that resolve to files outside the WordPress uploads directory. These files are then attached to admin notification emails via wp_mail(), exposing their contents. The vulnerability affects versions up to and including 6.2.1. There is no vendor-provided patch or official remediation at this time.

An authenticated attacker with administrator access can read arbitrary files on the web server that are readable by the web-server user. This includes sensitive files such as wp-config.php, which contains database credentials and authentication salts. The exposure occurs through admin notification emails that attach files from attacker-supplied URLs. While the email trigger can be initiated by unauthenticated users, the email recipient is fixed and not attacker-controlled, limiting the scope of data exfiltration. The vulnerability does not impact integrity or availability, only confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and avoid configuring admin notification emails to attach file-upload fields. Monitor vendor channels for updates and apply patches promptly once available.