CVE-2026-81297: CWE-266 Incorrect Privilege Assignment in WP Manage Ninja Fluent Forms Pro Add On Pack

This vulnerability (CVE-2026-81297) involves incorrect privilege assignment in the Fluent Forms Pro Add On Pack by WP Manage Ninja, specifically allowing subscriber-level users to escalate their privileges. The affected versions are up to 6.2.12. The CVSS 3.1 score is 7.5, reflecting a high impact with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow a subscriber user to gain higher privileges than intended, potentially leading to full compromise of the affected WordPress plugin functionality. This includes unauthorized access to sensitive data and the ability to modify or disrupt the plugin's operations, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber privileges or disabling the affected add-on if feasible to reduce risk.