Description

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T16:19:05.480Z",
  "pubdate": "2026-08-13T16:19:05.480Z",
  "executiveSummary": "Fluent Forms Pro version 6.2.7 is affected by an embedded malicious code vulnerability stemming from a compromised plugin build distributed through a decommissioned update server.\nThe vulnerability introduces a rogue PHP file that establishes a backdoor REST API endpoint, deploys persistent PHP payloads into the mu-plugins and uploads directories, provisions a passwordless administrator account, and registers scheduled tasks designed to persist even after the plugin is removed.\nThis supply chain compromise grants attackers comprehensive remote administrative control, arbitrary code execution, and long-term persistence capabilities on affected WordPress installations.\nExploitation requires administrators to download or update the plugin via the compromised decommissioned update server, after which the embedded backdoor executes automatically upon initialization of the plugin.",
  "technicalDetails": "The root cause of this vulnerability is a supply chain compromise involving a tampered plugin build distributed through an insecure or decommissioned update server.\nThe vulnerable component is Fluent Forms Pro version 6.2.7, specifically centered around the main plugin file fluentformpro.php and the injected rogue file libs/class-license-sync.php.\nExploitation occurs when the tampered build is installed or updated, executing a require_once directive added to fluentformpro.php that loads the malicious libs/class-license-sync.php payload during the WordPress bootstrap process.\nUpon initialization, the payload initiates several post-exploitation actions: it establishes a backdoor REST API endpoint for unauthorized remote interaction, drops persistent PHP files into the mu-plugins and uploads directories to ensure survival across reboots and administrative actions, provisions a rogue passwordless administrator account for direct authentication, and registers persistent scheduled tasks.\nThe attack flow operates entirely via local file inclusion and automated script execution triggered by plugin loading, requiring no prior authentication to execute the initial installation of persistent artifacts.\nThe impact includes complete system compromise, arbitrary code execution with administrative privileges, data exfiltration risks, and persistent unauthorized access that survives standard plugin removal procedures."
}