Threat database

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.

CVE-2026-109693 is an Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC's Fluent CRM plugin. It allows privilege escalation, potentially enabling an attacker with limited privileges to gain higher-level access. The vulnerability affects Fluent CRM versions from initial releases up to 3.2.5. The CVSS 3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

CVE-2026-109694 is a critical vulnerability in WP ManageNinja LLC's Fluent CRM plugin that allows incorrect privilege assignment leading to privilege escalation. It affects all versions from initial releases up to and including 3.2.5. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14.

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2.

CVE-2026-78279 is a Cross-Site Request Forgery (CSRF) vulnerability affecting WP ManageNinja LLC's Fluent Support Pro plugin versions up to and including 2.3.1. This vulnerability allows an unauthenticated attacker to trick a user into performing unwanted actions via a crafted request. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-78278 is an authorization bypass vulnerability classified as CWE-639 affecting WP ManageNinja LLC's Fluent Boards Pro plugin versions up to and including 2.0.11. It involves insecure direct object references (IDOR) that allow unauthorized access via user-controlled keys. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-78277 is a Server-Side Request Forgery (SSRF) vulnerability affecting WP ManageNinja LLC's FluentCRM Pro plugin versions up to and including 3.1.12. The flaw allows an attacker with low privileges to induce the server to make unauthorized requests, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity with a CVSS score of 4.9. No patch or remediation details are provided in the available data.

CVE-2026-78272 is a medium severity vulnerability in WP ManageNinja LLC's Fluent Support Pro plugin, affecting versions up to and including 2.3.1. It involves broken access control due to missing authorization checks, classified under CWE-862. The vulnerability allows attackers with limited privileges to access or perform actions beyond their authorization scope. No specific affected versions are listed beyond the indication of versions <= 2.3.1. There is no information about available patches or vendor advisories. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in low confidentiality and integrity impacts without availability impact.

CVE-2026-78270 is a high severity SQL Injection vulnerability in WP ManageNinja LLC's FluentCRM Pro plugin affecting versions up to and including 3.1.12. The flaw involves improper neutralization of special elements in SQL commands, specifically related to author input. This vulnerability could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and partial denial of service. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.