Description

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T21:17:50.297Z",
  "pubdate": "2026-08-31T21:17:50.297Z",
  "executiveSummary": "Fluent Forms Pro Add On Pack is susceptible to an unauthenticated broken access control vulnerability in all versions up to and including 6.2.12.\nThis flaw enables unauthenticated remote attackers to perform unauthorized actions or access restricted data by bypassing established authentication mechanisms.\nThe vulnerability stems from improper validation of request origin and authentication tokens within the plugin's architectural implementation, allowing malicious actors to interact with sensitive endpoints without prior session verification.\nThe risk implication is critical, as it potentially allows for unauthorized administrative operations, data exfiltration, or modification of form submissions and configurations.\nExploitation does not require prior knowledge of legitimate user credentials or complex bypass techniques, lowering the barrier to entry for attackers.\nOrganizations utilizing the affected versions are at risk of complete compromise of the plugin's functionality and associated data.",
  "technicalDetails": "The vulnerability resides in the access control logic governing request handling within the Fluent Forms Pro Add On Pack plugin. The root cause is a failure to consistently enforce authentication checks for critical API endpoints and internal callback functions.\nSpecifically, the plugin's request routing layer fails to verify the presence or validity of nonce values and user capability requirements before dispatching requests to administrative functions.\nUnder normal operation, the plugin is expected to confirm that a requester possesses sufficient privileges (e.g., 'manage_options') before executing sensitive operations. In the affected versions, the code path leading to these actions lacks an explicit authentication gate, permitting remote, unauthenticated HTTP requests to trigger restricted server-side logic.\nThe attack flow proceeds as follows: An attacker identifies an exposed endpoint within the plugin that performs sensitive data handling or system configuration. By crafting an HTTP request (typically GET or POST) targeting this endpoint, the attacker bypasses the application's authentication layer. Since the vulnerable component does not perform contextual validation of the request's origin or the user's session state, the server executes the associated functions as if they were initiated by an authorized administrator.\nThis behavior exposes several attack vectors, including the unauthorized extraction of stored form data, the alteration of form settings, or the injection of malicious payloads into the application’s backend if the endpoint interfaces with the database. Because this occurs at the network level and bypasses the frontend access controls, the impact is comprehensive regarding the plugin's functional scope.\nThe lack of integrity checks on these requests means that no specific exploit payload is required beyond the request structure itself. The vulnerability is inherently exposed to the network, and any actor with access to the web server's public-facing interfaces can initiate the exploitation sequence."
}