Technical impact
The vulnerability resides in the Fluent Forms plugin for WordPress, where the AJAX action `fluentform_ai_create_form` lacks proper capability checks. This oversight allows authenticated users who possess a Subscriber role or higher to create arbitrary forms through the publicly exposed AI Builder interface. The primary impact is the unauthorized creation of forms, which could be leveraged for phishing, spam, or other malicious content, representing a moderate‑severity privilege escalation flaw (CWE‑862).
Affected Systems
All instances of Techjewel's Fluent Forms plugin for WordPress with versions up to and including 6.1.7 are affected. No further version granularity is available in the CNA data.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood that this vulnerability is actively exploited. The issue is not listed in the CISA KEV catalog, implying it is not a known widely used exploit at the time of this analysis. Attackers would need to authenticate to the WordPress site with a Subscriber-level account or higher and then send a crafted AJAX request to the `fluentform_ai_create_form` endpoint, which the plugin fails to guard, thereby enabling creation of arbitrary forms.
