CVE-2026-73532 affects Fluent Forms Pro version 6.2.7, where a tampered plugin build introduced a rogue PHP file (libs/class-license-sync.php) loaded via require_once in fluentformpro.php. This backdoor establishes a REST API endpoint, drops persistent PHP files in mu-plugins and uploads directories, installs a passwordless admin account, and registers scheduled tasks that survive plugin removal. The malicious code was introduced through a compromised update server that is now decommissioned. The vulnerability allows unauthenticated remote attackers to gain persistent administrative access and maintain persistence on affected systems.

The vulnerability enables unauthenticated remote attackers to gain persistent administrative access by installing a passwordless administrator account. It also allows persistence through backdoor REST API endpoints, persistent PHP files in critical directories, and scheduled tasks that survive plugin removal. This can lead to full system compromise and long-term unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the tampered plugin build was served via a decommissioned update server, users should verify the integrity of their Fluent Forms Pro installation, remove the affected version 6.2.7, and update to a clean, verified version once available. Monitor for unauthorized administrator accounts and remove any suspicious scheduled tasks or PHP files in mu-plugins and uploads directories.