CVE-2026-73532 affects WPManageNinja's Fluent Forms Pro plugin version 6.2.7. The vulnerability arises from a tampered plugin build served through a decommissioned update server, which introduced a rogue PHP file (libs/class-license-sync.php). This file is loaded via a require_once directive in fluentformpro.php and establishes a backdoor REST API endpoint. The backdoor facilitates dropping persistent PHP files in mu-plugins and uploads directories, installing a passwordless administrator account, and registering scheduled tasks that survive even after the plugin is removed. This allows unauthenticated remote attackers to maintain persistent, high-privilege access to the affected WordPress environment.

The vulnerability enables unauthenticated remote attackers to execute arbitrary code with high privileges by exploiting the backdoor REST API endpoint. Attackers can maintain persistence through passwordless administrator accounts and persistent PHP files in critical WordPress directories. The scheduled tasks registered by the malicious code survive plugin removal, making remediation more complex and increasing the risk of long-term compromise. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the persistence mechanisms surviving plugin removal, affected installations should perform a thorough forensic analysis and clean-up, including removing rogue PHP files from mu-plugins and uploads directories, deleting unauthorized administrator accounts, and checking scheduled tasks. Monitor official WPManageNinja channels for an official fix or updated plugin build. Until a patch is available, consider disabling the affected plugin and restoring from a clean backup if possible.