The Fluent Forms plugin for WordPress versions up to and including 6.2.1 contains an Arbitrary File Read vulnerability. This flaw arises from insufficient path validation in the getAttachments() method of EmailNotificationActions, allowing authenticated administrators to read arbitrary files accessible by the web server. Attackers can exploit this by submitting a form with a crafted file-upload URL that traverses directories, potentially exposing sensitive files like wp-config.php. The vulnerable file is then attached to an admin notification email sent via wp_mail(). Although triggering the email can be done by unauthenticated users, the email recipient is fixed and not user-controlled.